Knowledgebase

Question

How can I add Content Security Policies to a WordPress installation?

Answer

1. Locate the functions.php file for your WordPress theme.
2. Open functions.php with your favorite editor and add the following code:

3. function add_custom_security_headers() {
   header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
   header("Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:");
   header("X-Frame-Options: SAMEORIGIN");
   header("X-Content-Type-Options: nosniff");
   header("Permissions-Policy: geolocation=(), microphone=()");
   header("Referrer-Policy: no-referrer-when-downgrade");
   }
   add_action('send_headers', 'add_custom_security_headers');

4. Save the file.