Security module Free feature

Security headers

Adds five HTTP response headers on every front-end page, telling browsers to block content sniffing, framing, and unnecessary device access.

Download Vectro free All features

What it does

Five instructions to the browser

Security headers is a Vectro security feature that adds five HTTP response headers to every front-end page, instructing browsers to block content sniffing, prevent framing, limit referrer leakage and deny camera, microphone and location access.

Security headers are lines your server sends alongside every page telling the browser what it is and is not allowed to do with your content. WordPress does not send them on front-end pages by default.

This feature adds five. X-Content-Type-Options stops the browser guessing a file type against what you declared. X-Frame-Options stops other sites embedding your pages in a frame. X-XSS-Protection enables the legacy filter in older browsers. Referrer-Policy limits how much of your URL is passed to sites your visitors click through to. Permissions-Policy switches off camera, microphone and geolocation access for your pages.

They apply to every front-end page, they need no configuration, and none of them changes how your pages look.

Why it matters

They shut down whole categories of attack

Without X-Frame-Options, an attacker can load your pages inside an invisible frame on a page they control and trick a logged-in visitor into clicking things they cannot see. That is clickjacking, and the header is the standard defence.

Without X-Content-Type-Options, a browser may sniff an uploaded file and decide a text file is really JavaScript, executing it. Referrer-Policy stops your full URLs – which can carry sensitive query parameters – leaking to every external site your visitors click to. Permissions-Policy means a compromised script cannot silently ask for camera or location access in your name.

Blocks clickjacking

X-Frame-Options SAMEORIGIN prevents other sites from embedding your pages in a frame.

Stops MIME sniffing

X-Content-Type-Options nosniff makes the browser respect the content type you declared.

Limits referrer leakage

Referrer-Policy strict-origin-when-cross-origin sends only the origin to external sites, not the full URL.

Denies device access

Permissions-Policy switches off camera, microphone and geolocation for your pages.

How to use it

Enable and confirm the headers arrive

Open the Security module

Go to Vectro > Security in wp-admin.

Toggle Security Headers on

All five headers are added to responses from this point.

Save Security Settings

No further configuration is required.

Check for duplicates

If your host or a security plugin already sets some of these, confirm you are not sending two conflicting values for the same header.

Verify with your browser tools

Open developer tools, reload your homepage, and inspect the response headers on the main document request.

Technical detail

The exact headers sent

Vectro adds the headers on the WordPress send_headers action, which runs for front-end page requests, rather than through server configuration, so the behaviour is identical on Apache, Nginx and LiteSpeed and survives a host migration.

If your server or another plugin already emits one of these headers, the browser may receive it twice. Duplicate or conflicting values can be ignored by the browser, so it is worth checking the response once after enabling.

X-Content-Type-Options

nosniff

X-Frame-Options

SAMEORIGIN

X-XSS-Protection

1; mode=block

Referrer-Policy

strict-origin-when-cross-origin

Permissions-Policy

geolocation=(), microphone=(), camera=()

Applied at

The WordPress send_headers action on front-end requests, not server config. Portable across hosts.

Watch for

Duplicate headers if your host or another plugin already sets them.

Compatibility

Vectro detects these and steps aside

Sucuri

Vectro stops sending all five headers while Sucuri Security is active, so the browser never receives a conflicting pair.

You can override any automatic deferral from the Compatibility panel in Vectro’s dashboard if you would rather Vectro handle it.

Questions

Frequently asked

What security headers does Vectro add to WordPress?

Vectro adds five headers: X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, X-XSS-Protection 1 mode=block, Referrer-Policy strict-origin-when-cross-origin, and Permissions-Policy denying camera, microphone and geolocation. WordPress sends none of these on front-end pages by default.

Does Vectro security headers work with Sucuri?

If Sucuri Security is active, Vectro detects it and stops sending all five of its headers, so the browser never receives a conflicting pair. Response headers are then left entirely to Sucuri and your server.

How do I add security headers to WordPress in Vectro?

Go to Vectro > Security in wp-admin and toggle Security Headers on. Open your browser developer tools afterwards and inspect the response headers on your homepage to confirm all five are arriving.

Are Vectro security headers free or Pro?

Yes, Vectro security headers is free. It is included in the free Vectro plugin on WordPress.org with no account required.

What happens if I deactivate Vectro with security headers enabled?

The five headers simply stop being sent, because Vectro adds them during the WordPress request rather than by editing your server configuration. Nothing is left behind in .htaccess or your nginx config to clean up.

Related features

Other defaults worth changing

Vectro Pro adds country blocking via GeoIP for traffic-level access control. See Pro plans

Download Vectro free on WordPress.org

27 features across Security, Performance and Maintenance. No account required, no expiry, unlimited sites.

Download Vectro free See Pro plans