whole For a complete list of how to configure CSS, see the content security policy quick reference guide.
X-content type-optionx-content-type-options HTTP security header is a non-standard header that all major browsers comply with to prevent XSS (cross site scripting) attacks caused by MIME type scanning. 5 . If present, this header will instruct the browser to strictly follow the MIME type defined in the content type HTTP header and tell the browser that it should not try to detect the correct MIME type of the response data itself. The title contains a single instruction called nosniff.
X-Content-Type-Options: nosniff
Obsolete or unused HTTP security headers also have many obsolete and unused HTTP security headers. It is introduced into temporary modification, test or non-standard plan, which is no longer used or completely replaced, so it is no longer used or no longer working. The following is a list of these HTTP security headers:
The HTTP security header is replaced by content security policy. The x-frame-optionx-frame-optionshttp security header relies on XSS (cross site script), click replay and other attacks of websites placed inside iframe. Now, this header has been replaced by the content security policy (CSP) instruction of frame consultants. It is recommended to use CSP with framework ancestor instructions instead of X-FRAME-OPTIONS. X-xss-protection the x-xss-protection HTTP security header is a non-standard header introduced to enable or disable browser protection against XSS (cross site scripting) attacks. In fact, this header is often easily bypassed by attackers and is ignored in most of the latest browsers.
The public key pins HTTP security header is used to configure the hpkp (public key fixation) security function introduced in Google Chrome and Firefox to prevent public key pin TLS certificate overflow. The function of hpkp is to let the web server provide the encrypted hash set of TLS certificate public key used on the website in the browser. The browser will use the hash set in turn and compare it with the certificate received from the server in subsequent requests. The problem is that hpkp management is quite complex, and there are often misconfigurations that completely disable website access, so it is recommended not to use it again.
It is best to configure HTTP or WordPress security headers in the web server or web application. This allows you to send on a per request basis. Alternatively, you can use the WordPress plug-in to set these headers, although not ideal. Now that we have discussed the purpose of the HTTP security header, there are several ways to enable it on the WordPress website. Use Apache HTTP server to add HTTP security headers to WordPress. The following is an example of the configuration of the Apache HTTP server required for HSTs (HTTP strict transport security), x-content-type-options, and activating the simple content security policy.
< ifModule mod_headers. c>
Header set Strict-Transport-Security \
Header set X-Content-Type-Options \
Header set Content-Security-Policy \
<\/ ifModule>
Similarly, use nginx to add HTTP security headers to WordPress.
The following is an example of the nginx configuration required to enable HSTs (HTTP strict transport security), x-content-type-options, and simple content security policies:
server {
add_header Strict-Transport-Security \
add_header X-Content-Type-Options \
add_header Content-Security-Policy \
}
Adding or modifying HTTP security headers to WordPress using plug-ins depends on WordPress itself, so the effect is poor, but using WordPress plug-ins may be the easiest way to add HTTP security headers to WordPress websites. Using plug-ins such as redirection plug-ins, you can add custom HTTP headers to your web site. How to check the HTTP security header on the website? If you add an HTTP security header on the word press website, you may want to ensure that the configuration is correct and works as expected. The easiest way to test this is to use a free tool called security header 6 To use the security header tool, simply enter the website URL and click Scan. We will introduce these grades from a + to F +, and then how to determine them. References used in this document [male + male] malereferences used in this document ******************************************************************** https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers ↑ 2 https:\/\/owasp.org\/www-project-secure-headers\/#http -strict-transport-security ↑ 3 https:\/\/web.dev\/what-is-mixed-content\/ 
↑ 4 https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/Content-Security-Policy-Report-Only
