In shortSecurity headers are lines the server sends with every page, asking the browser to behave more safely: always open your site over https, never show your site inside other sites, never guess file types, and only load scripts from approved sources. You add them with a few lines in .htaccess and test them with a free tool.
The most important security headers #
| Header | What it does | Suggested value |
|---|---|---|
| Strict-Transport-Security (HSTS) | Forces the browser to always open your site over https. | max-age=31536000 |
| X-Content-Type-Options | Stops the browser guessing file types and running an uploaded file as a script. | nosniff |
| X-Frame-Options | Stops your pages being shown in a frame on another site to trick visitors into clicking. | SAMEORIGIN |
| Referrer-Policy | Controls what part of your page URL is sent when visitors go to another site. | strict-origin-when-cross-origin |
| Permissions-Policy | Turns off browser features you do not need, such as camera and location. | camera=(), microphone=(), geolocation=() |
| Content-Security-Policy (CSP) | Lists the sources allowed for scripts and images, making XSS harder. | Needs tuning for each site |
How to add them #
- Back up your .htaccess file: From the cPanel File Manager in your site folder, so you can restore it if something breaks.
- Make sure your whole site works on https: Before adding HSTS, because browsers will refuse the unencrypted version for a long time. Read how to enable HTTPS on your website.
- Add the lines at the top of the file: Copy the lines below and save.
- Open your site and test key pages: Home page, dashboard, contact form and checkout.
- Test the result: A free tool such as
securityheaders.comshows which headers are present and missing.
<IfModule mod_headers.c> Header always set Strict-Transport-Security "max-age=31536000" Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "SAMEORIGIN" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()" </IfModule>
Be careful with CSP: a strict CSP can block analytics, payment and chat scripts. Start in report-only mode with
Content-Security-Policy-Report-Only, and enforce it once you are sure.If your site uses Cloudflare: you can enable HSTS in the Cloudflare SSL/TLS settings instead of the file. Do not set it in both places with different values.
How Hyyat Host protects your site #
- Our LiteSpeed and Apache servers read Header directives in .htaccess directly.
- A free SSL certificate is issued automatically on most plans, and it is required before HSTS.
- ModSecurity and Imunify360 rules complement security headers by blocking attacks at the server level.
Frequently asked questions #
Do security headers improve my Google ranking?
They are not a direct ranking factor, but they protect your visitors and reduce the chance of a hack that would hurt your visibility.
Is HSTS risky for my site?
Only if you add it before your whole site works on https. After that it is one of the most important headers.
Is there a WordPress plugin for security headers?
Yes, some security plugins add them. But adding them in .htaccess is lighter and also covers static files.
