Of everything we check across the 7.6 million WordPress sites in our dataset, one control is missing more consistently than any other: HTTP security headers. 82.7% of sites score an F on our header check, and fewer than 1.7% earn an A.
That's a shame, because security headers are the best effort-to-reward trade in web security. They're a handful of lines in a config file. They don't slow your site down. They don't break anything when set sensibly. And they quietly shut down clickjacking, protocol-downgrade attacks, MIME-sniffing exploits, referrer leakage, and more. If you fix nothing else on your site this month, fix these.
Here's what each one does, how widely it's ignored, and exactly how to add it.
What a security header actually is
Every time someone loads your site, your server sends back the page and a set of HTTP response headers — instructions the browser reads before rendering anything. Security headers are the subset of those instructions that tell the browser how to protect your visitors: which connections to trust, what content to block, what information to withhold. Set them once at the server or WordPress level and they apply to every page automatically.
The six headers that make up your grade
We grade each site on six standard headers. These are how many WordPress sites are missing each one, out of the 7.6 million we've scanned:
1. Strict-Transport-Security (HSTS) — missing on ~6.0M sites (79%)
Forces browsers to use HTTPS and refuse to downgrade to HTTP, closing the window where a visitor's first request can be intercepted. This one deserves special attention: 96% of the sites we scan already serve over HTTPS, but only about 1 in 5 sends HSTS. Almost everyone bought the certificate and then never told browsers to actually require it. If you have SSL but no HSTS — which describes most sites — you're getting a fraction of the protection you already paid for.
Strict-Transport-Security: max-age=31536000; includeSubDomainsAdd preload only once you're confident every subdomain is HTTPS-only — it's hard to undo.
2. Content-Security-Policy (CSP) — missing on ~7.1M sites (93.5%)
The most powerful header and the most-skipped, because it's the only one that takes real tuning. CSP controls which sources of scripts, styles, and other resources the browser is allowed to load, which is what makes it the strongest defense against cross-site scripting (XSS). Start in report-only mode so you can see what would break before you enforce it:
Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline'; script-src 'self'Watch the reports, widen the policy to cover the third parties you actually use, then switch -Report-Only off to enforce. This is the one header worth getting help with if you're unsure.
3. X-Content-Type-Options — missing on ~6.3M sites (82.5%)
A one-value header that stops browsers from "sniffing" a file's type and running, say, an uploaded image as a script. There's no downside and nothing to tune:
X-Content-Type-Options: nosniff4. X-Frame-Options — missing on ~6.6M sites (87.3%)
Prevents other sites from loading yours inside a hidden frame to trick your users into clicking things they didn't mean to (clickjacking). For most sites:
X-Frame-Options: SAMEORIGIN5. Referrer-Policy — missing on ~6.7M sites (87.7%)
Controls how much of the current URL is sent along when a visitor clicks away to another site — which matters if your URLs contain tokens, IDs, or anything you'd rather not leak. A good default:
Referrer-Policy: strict-origin-when-cross-origin6. Permissions-Policy — missing on ~6.7M sites (88.4%)
Lets you switch off browser features your site doesn't use — camera, microphone, geolocation — so a compromised script can't quietly turn them on. Deny what you don't need:
Permissions-Policy: geolocation=(), camera=(), microphone=()How to add them
Pick the method that matches how your site is hosted. All of them apply the headers site-wide.
Apache (.htaccess or vhost):
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
</IfModule>Nginx (inside your server block):
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;No server access? A security plugin (Wordfence, Really Simple Security, and others) can set most of these from the WordPress dashboard with a toggle. It's slightly less flexible than doing it at the server, but for the five easy headers it's more than enough to move from an F to a B.
Add CSP separately once the other five are in place and verified — it's the only one that needs testing against your specific site.
Check your work
After deploying, confirm the headers are actually being sent — a typo in .htaccess or a caching layer stripping headers is common. Run your domain through our free security header check and you'll see your new grade and any headers still missing in a few seconds. Getting from F to A is usually a single afternoon's work.
Frequently asked questions
Do security headers slow down my site?
No. They're a few hundred bytes added to responses your server already sends. There's no measurable performance cost, and nothing to load or execute.
Will adding these break my site?
Five of the six are safe to set as shown for the vast majority of sites. The exception is Content-Security-Policy: a strict CSP can block legitimate scripts (analytics, embeds, page builders), which is exactly why you roll it out in -Report-Only mode first, watch what it would have blocked, and only enforce once it's clean.
Can I add security headers without server (SSH/config) access?
Yes — a security plugin can set the five simple headers from the WordPress dashboard. It's the easiest route from an F to a B. For fine-grained CSP control you'll eventually want server-level access, but it isn't required to start.
What's the difference between having an SSL certificate and having HSTS?
The certificate enables HTTPS; HSTS enforces it. Without HSTS, a browser can still be tricked into connecting over plain HTTP first. 96% of the sites we scan have the certificate; only about 1 in 5 sends HSTS — so this is the most common gap worth closing.
How many headers do I need for a passing grade?
On our scale, missing two or fewer keeps you at C or better; missing five or six is an F. Realistically, the five easy headers alone move most sites from an F straight to a B, and adding a tuned CSP gets you to A.
Is X-XSS-Protection one of these?
No — it's deprecated and modern browsers ignore it. The modern replacement is Content-Security-Policy, which is why it's on the list and the old header isn't.
If you'd like the full context on where these numbers come from, our 2026 State of WordPress Security report breaks down headers alongside username leaks, exposed files, malware, and outdated core across 7.6 million sites.
Not sure which CSP is safe for your site, or managing headers across a lot of sites at once? We harden WordPress security headers (and everything around them) as a service. Reach out and we'll get your grade up.