Security Headers
Headers should be placed through WP Engine by going into the environment and adding through Web Rules under the Advanced section. Special care should be taken when adding these because this can prevent certain traffic and features from working on the site.
If this is your first time adding, be sure to research the header and/or speak with other developers on the functionality.
Required Headers
Replace all domain.com with the appropriate root domain. Be sure to follow the exact formatting below.
WP Engine-specific notes
Action should typically always be “set” unless you’re specifically removing a default header set by WP Engine.
When should also generally be “only on success”
Cross-Origin-Resource-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin
Access-Control-Allow-Origin: https://domain.com/
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Permissions-Policy: geolocation=(self "https://domain.com"), accelerometer=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-originOnly use the following header for Cross-Origin Isolation. It will not allow external embeds without the origin being defined (or crossorigin=”anonymous” being added) and is best left off unless there is a good use case.
Cross-Origin-Embedder-Policy: require-corpSuggested Headers
The CSP header prevents any external sourced resource from loading on the site without being explicitly whitelisted. This list below covers all standard integration for Google tracking, Yoast integration, Gravatar integration, and Google/Adobe fonts. This should only be treated as a starting point and all appropriate sources should be added.
Content-Security-Policy: default-src 'self' 'unsafe-inline'; script-src 'self' https://www.google.com https://www.gstatic.com https://www.googletagmanager.com blob: 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://google.com https://analytics.google.com https://yoast.com; img-src 'self' https://www.googletagmanager.com data: https://secure.gravatar.com https://lh3.googleusercontent.com; style-src 'self' https://use.typekit.net https://p.typekit.net https://fonts.googleapis.com https://www.gstatic.com 'unsafe-inline'; font-src 'self' https://use.typekit.net data: https://fonts.gstatic.com 'unsafe-inline'; frame-src 'self' https://td.doubleclick.net https://www.google.com;
A good practice is to add this security header to a dev environment, use the site as normal, and check the console for any blocked resources.