HTTP Headers
The HTTP Headers tab configures security-related HTTP response headers via .htaccess. These headers instruct browsers to apply additional security policies that protect visitors from certain classes of attack.
Changes to HTTP headers via .htaccess may conflict with headers already set by your hosting provider, a CDN, or another plugin. If your site becomes inaccessible after saving, restore your .htaccess file from backup and check for conflicts.
Some hosting providers set Header always directives in their server configuration. SecurityCheck Pro adds rules at the .htaccess level, which may be overridden by server-level configuration. An informational notice is displayed on this tab to remind you.
Options
| Option | Description |
|---|---|
| X-Frame-Options | Controls whether the page can be embedded in an iframe. Options: No (disabled), DENY (never allow framing), SAMEORIGIN (allow framing only from the same domain). |
| Prevent MIME Attacks | Adds the X-Content-Type-Options: nosniff header, preventing browsers from MIME-sniffing a response away from the declared content type. |
| HSTS Options | Adds the Strict-Transport-Security header, instructing browsers to always use HTTPS for this domain. Only enable this if your site is served exclusively over HTTPS. |
| XSS Protection | Adds the X-XSS-Protection header. Note: this header is deprecated in modern browsers in favour of Content Security Policy, but is still honoured by some older clients. |
| CSP Policy | Sets the Content-Security-Policy header. Enter your full policy string in the text field (e.g. default-src 'self'). Leave empty to disable. |
| Referrer Policy | Sets the Referrer-Policy header. Enter the policy value (e.g. strict-origin-when-cross-origin). Leave empty to disable. |
| Permissions Policy | Sets the Permissions-Policy header. Enter the policy string to control browser feature access. Leave empty to disable. |
When a header rule has been written to the .htaccess file, a green check-mark icon appears next to the option label.
