Securing a WordPress site

Every security header in .htaccess

Open the .htaccess file in your WordPress root folder through your host's file manager or FTP, and back it up first. Paste this block near the top, outside the # BEGIN WordPress section, which WordPress rewrites. The Content Security Policy starts in report-only mode, so it changes nothing for visitors yet.

If your host runs Nginx or doesn't allow .htaccess (some managed WordPress hosts don't), ask them to add these headers, or use a headers plugin.

How to fix it on WordPress (Apache .htaccess)

1. Open the .htaccess file in your WordPress root folder (via your host's file manager or FTP). Make a backup copy first.
2. Paste the block below near the top, outside the '# BEGIN WordPress' section, and save.
3. If your host runs Nginx instead of Apache, or doesn't allow .htaccess, a plugin like 'Headers Security Advanced & HSTS WP' can set these instead.
4. The Content-Security-Policy-Report-Only line changes nothing for visitors yet. After a week with no broken features (check your browser's console), rename it to Content-Security-Policy to switch it on.

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set Content-Security-Policy-Report-Only "default-src 'self' https:; img-src 'self' https: data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; upgrade-insecure-requests"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

Redirect everything to HTTPS

Turn on your host's free certificate first, then make sure both addresses in Settings > General start with https://.

How to fix it on WordPress (Apache .htaccess)

1. In WordPress go to Settings > General and make sure both addresses start with https://.
2. Add this to the top of your .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Fix mixed content

Sites that moved to HTTPS often still have old http:// addresses stored in posts and settings. A search-and-replace across the database fixes them all at once. Back up first.

How to fix it on WordPress

1. Install the 'Better Search Replace' plugin and replace http://example.com with https://example.com in all tables (back up first).
2. For third-party files, change their links to https://. Most providers support it.

wp search-replace 'http://example.com' 'https://example.com' --all-tables

Block private files

Backups, .env files and .git folders left in your WordPress folder can be downloaded by anyone. This rule blocks every hidden file except /.well-known/.

How to fix it on WordPress (Apache .htaccess)

1. Treat every password and key in that file as stolen. Change them all now: database password, API keys, payment keys, email passwords.
2. Delete the exposed file or folder from your web root.
3. Add this to your .htaccess (Apache) so hidden files are always blocked.
4. Afterwards, open the address again in a private window and confirm it shows an error page.

<FilesMatch "^\.(?!well-known)">
  Require all denied
</FilesMatch>
RedirectMatch 404 /\.git

Protect login cookies

Cookies without the Secure, HttpOnly and SameSite flags are easier to steal. These PHP settings cover session cookies; cookies set by a plugin need that plugin's settings.

How to fix it on PHP

1. Set these in php.ini (or your host's PHP options) to protect session cookies:
2. For cookies set by a plugin, check that plugin's settings or ask its developer.

session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = Lax

Your domain's email records

Add these wherever your domain's DNS lives, often your host's control panel or your registrar. WordPress sends email too (password resets, order emails), so include whichever service it sends through. Our email guide explains each record.

How to fix it

1. Log in to wherever you manage your domain's DNS (your registrar, Cloudflare, etc.).
2. Add both records below to example.com. If there's already a TXT record starting with v=spf1, replace it: a domain must have only one.
3. Replace the <...> part with your email provider's SPF include: Google Workspace is _spf.google.com, Microsoft 365 is spf.protection.outlook.com. Add one for each service that sends email as you.
4. If you're not sure every service that sends email as you is listed, start with p=none for two weeks and read the reports, then change it to p=quarantine.

Type: TXT
Name: @
Value: v=spf1 include:<your email provider's SPF domain> -all

Type: TXT
Name: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com