How to Fix Missing Security Headers (Step-by-Step Guide)
By Marcus Reeve — Lead Security Analyst at EzyAudit AI
If a security scan has told you that your website is missing security headers, the good news is that this is one of the easiest and cheapest wins in all of web security. A few lines of configuration can close off entire classes of attack — clickjacking, protocol downgrade, MIME-sniffing and more — in a couple of minutes. This guide shows you exactly how to fix missing security headers, with copy-and-paste snippets.
What are security headers, and why do missing ones matter?
Security headers are short instructions your server sends with every page, telling the browser how to behave safely: force HTTPS, refuse to be embedded in a hostile iframe, block risky scripts, and so on. When they are missing, the browser falls back to permissive defaults — and that gap is exactly what attackers exploit. Adding them is free, and it immediately improves both your real-world security and your security score.
Not sure which headers you are missing?
EzyAudit AI checks every security header, grades each one, and tells you exactly what to add.
The security headers that matter (and how to add each one)
Below are the headers worth setting, what each one does, and the exact value to use. If your site runs on Apache or LiteSpeed (which includes most WordPress hosting), you can add them all at once in your .htaccess file:
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'"
</IfModule>Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS for your whole domain, which shuts down downgrade and cookie-hijacking attacks. Only add it once you are confident HTTPS works everywhere. If SSL is new to you, our complete SSL guide covers the groundwork.
Content-Security-Policy (CSP)
The most powerful header of all: it controls which scripts, styles and images the browser is allowed to load, which is your best defence against cross-site scripting. Start with a relaxed policy like the one above and tighten it as you confirm nothing breaks.
X-Frame-Options
Stops other sites from loading yours inside an iframe, which prevents clickjacking. SAMEORIGIN allows your own site to frame its pages while blocking everyone else.
X-Content-Type-Options
The value nosniff stops browsers from guessing (and mis-executing) file types — a simple, safe one-liner with no downside.
Referrer-Policy
Controls how much of your URL is shared when visitors click away, protecting potentially sensitive query parameters. strict-origin-when-cross-origin is a sensible default.
Permissions-Policy
Switches off browser features you do not use — camera, microphone, geolocation — so a compromised script cannot abuse them.
How to add security headers in WordPress
You have three options, easiest first:
- Edit
.htaccess(Apache/LiteSpeed): paste the block above near the top of the.htaccessfile in your site root. This is the most common setup for WordPress hosting. - Nginx: add the same headers using
add_headerdirectives in your server block, then reload Nginx. - A plugin: if you would rather not touch config files, a reputable headers plugin can set these from the WordPress dashboard.
Always back up the file you are editing first, and re-test your site afterwards — an over-strict Content-Security-Policy is the one header that can hide images or styles until you widen it.
How to verify your security headers are working
After adding them, confirm they are actually being sent. The fastest way is to re-run a scan: EzyAudit AI re-checks every header, shows you the new grade, and flags anything still missing or misconfigured — including a CSP that is too strict.
Check your fix in about a minute
Re-scan free to confirm your headers, then subscribe for continuous monitoring so a change never slips past you.
Frequently asked questions
What are security headers?
Security headers are HTTP response headers your server sends with every page that tell the browser how to behave securely — for example, to force HTTPS, block clickjacking, or restrict which scripts can run. Missing headers leave the browser on permissive defaults that attackers can exploit.
Which security headers are the most important?
The highest-impact headers are Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Adding all six takes only a few lines of configuration.
How do I add security headers in WordPress?
The easiest way on most WordPress hosting is to paste a mod_headers block into your site root .htaccess file. On Nginx you use add_header directives in the server block, and if you prefer not to edit files, a reputable security-headers plugin can set them from the dashboard.
How do I check if my security headers are working?
Re-scan your site. EzyAudit AI inspects every security header, grades each one, and flags anything still missing or misconfigured — including a Content-Security-Policy that is too strict and may be hiding content.
Want the bigger picture? See our guide to the best free website security scanners in 2026 and how to fix vulnerable WordPress plugins.