Skip to content

Instantly share code, notes, and snippets.

@luizbills

luizbills/code.php

Last active September 19, 2023 16:37
Show Gist options
  • Save luizbills/0ac0627aae6bdbb6047ddb4b04c4cdb6 to your computer and use it in GitHub Desktop.
Save luizbills/0ac0627aae6bdbb6047ddb4b04c4cdb6 to your computer and use it in GitHub Desktop.
Download ZIP
Add some security-related headers to your WordPress. You can check your headers in https://securityheaders.com/
Raw
code.php
<?php
add_action( 'wp_headers', 'lpb_add_security_headers' );
function lpb_add_security_headers ( $headers ) {
$headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains; preload';
$headers['X-Content-Type-Options'] = 'nosniff';
$headers['X-XSS-Protection'] = '1; mode=block';
$headers['Content-Security-Policy'] = "default-src 'self'; connect-src *; font-src * data:; frame-src *; img-src * data:; media-src *; object-src *; script-src * 'unsafe-inline' 'unsafe-eval'; style-src * 'unsafe-inline'";
return $headers;
}
@luizbills
Copy link
Author

You can use https://github.com/april/laboratory to generate a more apropriate Content-Security-Policy for your site.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment