World Class Digital
Home / Help Center / Add security headers
Help Center · Website

How to add security headers

Security headers are short instructions your website sends to every visitor's browser, like "only load me over HTTPS" and "don't let other sites frame me". They are invisible to visitors and close off a few common tricks.

By Sam Margolis · Updated 2026-11-05

The four headers the checkup looks for

  • Strict-Transport-Security (HSTS). Tells browsers "always use HTTPS for this site", so nobody on a coffee shop network can quietly downgrade a visitor to an unencrypted connection.
  • X-Content-Type-Options: nosniff. Tells browsers not to guess what kind of file something is. It stops an uploaded file from being run as a script.
  • X-Frame-Options, or the CSP frame-ancestors rule. Stops other websites from loading your site inside a hidden frame to trick visitors into clicking things (called clickjacking).
  • Content-Security-Policy (CSP). A list of where your site is allowed to load scripts, styles and images from. Done well, it blocks injected scripts. Done carelessly, it breaks your site, so it gets its own warning below.

Where you add them depends on how your site is hosted. Find yours below.

cPanel and other Apache hosts

Most cPanel hosting runs Apache (or LiteSpeed, which reads the same file). You add headers in a file called .htaccess in your site's main folder, usually public_html.

  1. Make a backup. In cPanel, open File Manager, go to public_html, turn on "Show Hidden Files" in Settings, and download a copy of .htaccess before you touch it.
  2. Edit the file and add the block below at the top. If there is a WordPress section (between # BEGIN WordPress and # END WordPress), put yours above it, not inside it.
  3. Save, then load your site in a private browser window and click around: home page, contact form, checkout if you have one.
  4. If anything looks wrong, put the backup back. That is the whole undo.
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Content-Security-Policy "frame-ancestors 'self'; base-uri 'self'"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

What this does, line by line: HTTPS is remembered for a year; no file-type guessing; only your own site may frame your pages; a small, low-risk CSP that adds the same framing rule and blocks one injection trick; and a referrer setting that shares less with other sites. I use SAMEORIGIN rather than DENY because some page builders preview your site inside a frame of itself.

Before HSTSOnly add Strict-Transport-Security once your site works fully on HTTPS, with a valid certificate. Browsers remember it, so a broken certificate afterwards locks visitors out until it is fixed. If you are nervous, start with max-age=300 (five minutes) for a week, then raise it. See the SSL guide first if your certificate has problems.
Test CSP carefullyA full Content-Security-Policy that lists every allowed script source is the strongest of these headers and the easiest to get wrong. Analytics, chat widgets, booking embeds, payment forms and fonts all load from other domains, and a strict policy blocks anything you forgot. To try one safely, send it as Content-Security-Policy-Report-Only first, browse your site with the browser's developer console open, and fix every blocked item before switching to the real header. The small policy in the snippet above does not restrict scripts, which is why it is safe to start with.

WordPress

WordPress itself does not set these headers. You have three options, in the order I would try them:

  1. Ask your host. Many managed WordPress hosts have a security headers or HSTS switch in their dashboard. It is the cleanest option because it survives plugin and theme changes.
  2. Use .htaccess if your host is cPanel or Apache. Follow the cPanel steps above.
  3. Use a plugin. Several reputable security and header plugins can add them. Pick one that is actively maintained and widely installed, and do not stack two plugins that both set headers.

If your WordPress site sits behind Cloudflare, you can also add headers there with a response header rule, which keeps them in one place.

Wix, Squarespace, Shopify and GoDaddy Website Builder

These platforms run the servers for you, so you cannot add headers yourself. They set their own, and many already send HTTPS and framing protection. If the checkup flags a missing header on one of these platforms, there is nothing you did wrong. You can contact the platform's support and ask about it, but for most small businesses on these platforms this is a low-priority finding. Spend your effort on email protection first.

Stuck?Run the free checkup again after your change, or ask a tech question.
Straight answers

Security header questions

Will adding headers slow down my site?

No. They are a few lines of text sent with each page. Visitors will not notice anything.

Do I need X-Frame-Options if I have CSP frame-ancestors?

Modern browsers follow frame-ancestors and ignore X-Frame-Options when both are present. Sending both costs nothing and covers older browsers, which is why the snippet includes both.

I added the snippet and my site shows a server error. What now?

Put your backup of .htaccess back right away and the site will return. The error usually means a typo or a host that does not allow header changes in .htaccess. Your host's support can tell you which.

Check your work

Made the change? Run the checkup again.

The free checkup reads the headers your site sends and shows which ones are in place.

Run the free checkup Ask a tech question