Security Headers code for WordPress
IMPORTANT!
Before editing the .htaccess file, it is best practice to save a copy of the original .htaccess file locally just in case anything goes wrong and you have a previous version to go back to.
4. Copy and paste this code at the bottom of your .htaccess file:
# OCTAVE Security Headers
Header always set Strict-Transport-Security: “max-age=31536000” env=HTTPS
Header always set Content-Security-Policy “upgrade-insecure-requests”
Header always set X-Content-Type-Options “nosniff”
Header always set X-XSS-Protection “1; mode=block”
Header always set Expect-CT “max-age=7776000, enforce”
Header always set Referrer-Policy: “no-referrer-when-downgrade”
Header always set X-Frame-Options: “SAMEORIGIN”
Header always set Permissions-Policy: “geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);”
# End OCTAVE Security Headers
