Quick Diagnosis
Missing headers are usually configuration gaps, not proof that a site is compromised.
Problem
WordPress Security Headers Missing
Understand missing WordPress security headers by checking HTTPS, CDN or server ownership, header conflicts, and realistic browser-protection impact.
Problem
The public response is missing one or more browser security headers that may reduce protection against common client-side risks.
For: Site owners reviewing public security header findings.
Workflow
What to review
CSP Care
Content-Security-Policy can break scripts and checkout flows if copied blindly.
WordPress SecuritySeverity: LowLast reviewed: 2026-09-16
Diagnosis
Symptoms, causes, checks, and fixes
Symptoms
- A public scanner reports missing HSTS, CSP, X-Content-Type-Options, Referrer-Policy, or related headers.
- Headers differ between www/non-www or CDN/origin responses.
Most Common Causes
- Headers not configured at server/CDN.
- Plugin only adds headers for some responses.
- Conflicting cache layer strips headers.
- CSP not designed yet.
How To Confirm The Cause
- Check final HTTPS response headers.
- Compare homepage, admin, assets, and redirected URLs.
- Identify whether CDN, server, or WordPress owns response headers.
Fixes
- Add conservative headers at the server or CDN when possible.
- Test CSP carefully before enforcing.
- Keep header behavior consistent across canonical URLs.
How To Verify The Fix
- Repeat header checks after cache purge.
- Confirm no browser console breakage.
- Validate important pages still load assets.
When To Contact Support
Contact hosting/CDN support when headers must be set outside WordPress.
References
Official references
Continue