Security Headers

snippet.php

// Headers
if (!empty($_SERVER['HTTPS'])) {
    function add_hsts_header($headers) {
        $headers['strict-transport-security'] = 'max-age=31536000; includeSubDomains';
        $headers['x-xss-protection'] = '1; mode=block';
        $headers['x-content-type-options'] = 'nosniff';
        $headers['x-frame-options'] = 'SAMEORIGIN';
        $headers['referrer-policy'] = 'no-referrer-when-downgrade';
        $headers['permissions-policy'] = 'geolocation=(); midi=(); notifications=(); push=(); sync-xhr=(); microphone=(); camera=(); magnetometer=(); gyroscope=(); vibrate=(); fullscreen=(); payment=()';
        $headers['content-security-policy'] = 'default-src \'self\' \'unsafe-inline\' \'unsafe-eval\' https: data:';
        $headers['expect-ct'] = 'max-age=3600; enforce';
        return $headers;
    }
    add_filter('wp_headers', 'add_hsts_header');
}