![\"Not](\"https:\/\/res.cloudinary.com\/ccsimmons\/images\/w_579,h_224,c_scale\/f_auto,q_auto\/v1769181361\/Screenshot-2026-01-19-at-6.50.54-PM_2938d5b26\/Screenshot-2026-01-19-at-6.50.54-PM_2938d5b26.png?_i=AA\")
All of these headers can be set at CloudFlare:<\/p>\n
- \n
- Upgrade Insecure Requests<\/li>\n
- X-XSS protection<\/li>\n
- X-Content Type Options<\/li>\n
- Referrer-Policy<\/li>\n
- Permissions-Policy<\/li>\n
- HTTP Strict Transport Security<\/li>\n<\/ul>\n
Review site headers using curl<\/h2>\n
To see what headers are being returned from a website use the following command:
curl -I foo.com<\/code><\/p>\ncurl is a command-line tool for making HTTP\/HTTPS requests. The request defaults to https.<\/p>\n
- \n
- The
-I<\/code> parameter tells curl to:<\/li>\n- Send an HTTP HEAD<\/strong> request instead of GET<\/li>\n
- Return headers only<\/strong><\/li>\n
- Skip downloading the response body (HTML, JSON, etc.)<\/li>\n<\/ul>\n
![\"curl](\"https:\/\/res.cloudinary.com\/ccsimmons\/images\/w_300,h_126,c_scale\/f_auto,q_auto\/v1769181872\/curl_2941598b5\/curl_2941598b5.png?_i=AA\")
curl command<\/figcaption><\/figure>\n Cloudflare \u2013 Add a Response Header Transform Rule<\/p>\n
- \n
- Log in to Cloudflare and select a domain.<\/li>\n
- Go to
Rules \u2192 Overview<\/code>.<\/li>\n- Click Create rule<\/b> and choose
Response Header Transform Rules<\/code><\/li>\n- Give the rule a clear name. Example:
Security Headers (WordPress Site Health)<\/code><\/li>\n- Set
All incoming requests<\/code> toApply this rule to all requests<\/code>.<\/li>\n- Under Then<\/b>, choose Set static<\/b> and enter the Header name<\/b> and Value<\/b> you want to add or modify.<\/li>\n
- Click
Set new header<\/code> to add additional headers if needed<\/li>\n- Click
Deploy<\/code> to activate the rule.<\/li>\n<\/ul>\n![\"Response](\"https:\/\/res.cloudinary.com\/ccsimmons\/images\/w_1024,h_906,c_scale\/f_auto,q_auto\/v1769182051\/response-header-transform-rule\/response-header-transform-rule.png?_i=AA\")
Response Header Transform Rule<\/figcaption><\/figure>\n Recommended Header Name and Value Settings<\/p>\n
\n\n
\n <\/th>\n Header name<\/th>\n Value<\/th>\n<\/tr>\n \n Set static<\/td>\n Content-Security-Policy<\/td>\n upgrade-insecure-requests<\/td>\n<\/tr>\n \n Set static<\/td>\n Permissions-Policy<\/td>\n geolocation=(), microphone=(), camera=()<\/td>\n<\/tr>\n \n Set static<\/td>\n Strict-Transport-Security<\/td>\n max-age=31536000; includeSubDomains; preload<\/td>\n<\/tr>\n \n Set static<\/td>\n X-Content-Type-Options<\/td>\n nosniff<\/td>\n<\/tr>\n \n Set static<\/td>\n X-XSS-Protection<\/td>\n 1; mode=block<\/td>\n<\/tr>\n \n Set static<\/td>\n strict-origin-when-cross-origin<\/td>\n Referrer-Policy<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Settings Explanation<\/h2>\n
- \n
- Content-Security-Policy: upgrade-insecure-requests<\/b> \u2014 Automatically upgrades all HTTP resource requests to HTTPS to prevent mixed-content issues and improve transport security.<\/li>\n
- Permissions-Policy: geolocation=(), microphone=(), camera=()<\/b> \u2014 Explicitly disables access to geolocation, microphone, and camera APIs for the site and all embedded content.<\/li>\n
- Strict-Transport-Security: max-age=31536000; includeSubDomains; preload<\/b> \u2014 Forces browsers to use HTTPS only for one year for the site and all subdomains and signals eligibility for browser HSTS preload lists. (Note: the header name should be<\/i> Strict-Transport-Security<\/i>*.)*<\/li>\n
- X-Content-Type-Options: nosniff<\/b> \u2014 Prevents browsers from MIME-sniffing responses and forces them to respect the declared Content-Type.<\/li>\n
- X-XSS-Protection: 1; mode=block<\/b> \u2014 Enables the browser\u2019s legacy XSS filter and blocks rendering of the page if an attack is detected.<\/li>\n
- Referrer-Policy: strict-origin-when-cross-origin<\/b> \u2014 Sends the full referrer URL for same-origin requests but only the origin for cross-origin requests, and nothing when downgrading from HTTPS to HTTP.\u2800<\/li>\n<\/ul>\n
Confirm Response Header Transform Rule<\/h2>\n
To confirm the new headers are being returned use the
curl<\/code> command from earlier:<\/p>\ncurl -I foo.com<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"Site Health Security Error Security headers can be a frequently failed item in WordPress Site Health. The error in Site Health is: All of these headers can be set at CloudFlare: Upgrade Insecure Requests X-XSS protection X-Content Type Options Referrer-Policy Permissions-Policy HTTP Strict Transport Security Review site headers using curl To see what headers are … Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_cloudinary_featured_overwrite":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[68],"tags":[69,77],"class_list":["post-2937","post","type-post","status-publish","format-standard","hentry","category-developer","tag-cloudflare","tag-wordpress"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pbVg43-Ln","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/posts\/2937","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/comments?post=2937"}],"version-history":[{"count":0,"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/posts\/2937\/revisions"}],"wp:attachment":[{"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/media?parent=2937"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/categories?post=2937"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/csimmons.dev\/blog\/wp-json\/wp\/v2\/tags?post=2937"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Permissions-Policy: geolocation=(), microphone=(), camera=()<\/b> \u2014 Explicitly disables access to geolocation, microphone, and camera APIs for the site and all embedded content.<\/li>\n
- Click Create rule<\/b> and choose
- Send an HTTP HEAD<\/strong> request instead of GET<\/li>\n
- The