WordPress security header settings for 2023

wordpress-security-headers-2023.php

<?php
// Define helper functions

/**
 * Changes default WordPress headers to a custom ones
 */
function change_cors_headers() {
  remove_filter( 'rest_pre_serve_request', 'rest_send_cors_headers' );
  add_filter( 'rest_pre_serve_request', 'send_cors_headers' );
}
/**
 * Set Content-Security-Policy header, 
 * sets default source for all objects to the existing site
 * restricts the use of content in embeded objects to the same origin
 */
function send_content_security_policy() {
  header( 'Content-Security-Policy: default-src \'self\'; frame-ancestors \'self\';' );
};

/**
 * Update the CORS headers to be restricted to the existing domain
 */
function send_cors_headers($value) {
  $origin = get_http_origin();
  $site_domain = $_SERVER['SERVER_NAME'];

  if ( $origin ) {
    // Requests from file:// and data: URLs send "Origin: null".
    if ( 'null' !== $origin ) {
      $origin = esc_url_raw( $origin );
    }
    header( 'Access-Control-Allow-Origin: ' . $site_domain );
    header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
    header( 'Access-Control-Allow-Credentials: true' );
    header( 'Vary: Origin', false );
  }  elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
    header( 'Vary: Origin', false );
  }

  return $value;
}

/**
 * Set permission policy header for default features
 */
function send_permissions_policy() {
  header( 'Permissions-Policy: camera=(self), fullscreen=(), geolocation=(self), microphone=(self), payment=(self), publickey-credentials-get=(self), web-share=(self)' );
}

/**
 * Restrict the amount of information that is sent with the referrer policy 
 * include only the minimally necessary information
 */
function send_referrer_policy() {
  header( 'Referrer-Policy: strict-origin-when-cross-origin' );
}

// Add actions and filters for all headers
// Update CORS headers, see function above
add_action('rest_api_init', 'change_cors_headers' );

// Disable XMLRPC, as it is no longer in use
add_filter('xmlrpc_enabled', '__return_false');

// Restirct X-Frame-Options to same origin
// `send_frame_options_header` is defined in WordPress core in /wp-includes/functions.php
add_action( 'send_headers', 'send_frame_options_header', 10, 0 );

// Send nosniff header
// `send_nosniff_header` is defined in WordPress core in /wp-includes/functions.php
add_action( 'send_headers', 'send_nosniff_header', 10, 0);

// Set security policy header
add_action( 'send_headers', 'send_content_security_policy', 10, 0);

// Set permissions policy header
add_action( 'send_headers', 'send_permissions_policy', 10, 0);

// Set referrer policy header
add_action( 'send_headers', 'send_referrer_policy', 10, 0);