I went down an interesting rabbit hole after finding securityheaders.com and hstspreload.org. To get an A+ rating for my blog, I worked through all of their suggestions. I won’t detail each one, but below is the set of HTTP security headers I’ve landed on that works for my WordPress site.
Add These Headers to .htaccess
Add the following to the .htaccess file on your Apache web server (the mod_headers module must be enabled). Replace yoursite.com with your own domain.
Header set Content-Security-Policy "upgrade-insecure-requests"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-Xss-Protection "1; mode=block"
Header set Referrer-Policy "strict-origin"
Header set Permissions-Policy "geolocation=self"
Header set Access-Control-Allow-Origin "https://*yoursite.com*"
Header set Cross-Origin-Embedder-Policy "unsafe-none"
Header set Cross-Origin-Opener-Policy "unsafe-none"
Header set Cross-Origin-Resource-Policy "same-site"After saving the file, rescan your site at securityheaders.com to confirm the grade. Related: Apache reverse proxy configuration and configuring Apache mod_rewrite.