Security headers tell browsers how to treat your site: always use HTTPS, do not allow framing by other sites, do not guess file types. They are easy to add on LiteSpeed because it supports Apache's Header directive in .htaccess.
Before you start
- A valid SSL certificate and HTTPS working (see AutoSSL and forcing HTTPS).
- Access to
public_html/.htaccessvia File Manager (show hidden files) or FTP, and a backup copy of it.
Recommended baseline
Add these lines near the top of .htaccess:
<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>| Header | What it does |
|---|---|
| X-Content-Type-Options | Stops browsers guessing file types, blocking some injection tricks |
| X-Frame-Options | Prevents other sites from framing your pages (clickjacking) |
| Referrer-Policy | Limits what URL information is sent to other sites |
| Permissions-Policy | Disables browser features your site does not use |
HSTS: force HTTPS in the browser
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"Warning: With HSTS, browsers refuse plain HTTP for the whole max-age period. Make sure every subdomain has working SSL before adding includeSubDomains. Start with a short max-age, such as 300, and raise it after testing.
Content-Security-Policy (advanced)
CSP controls which sources may load scripts, styles and images. It is powerful but easy to get wrong. Start in report-only mode:
Header always set Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https:; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:"Watch the browser console for violations, adjust, and switch to the enforcing Content-Security-Policy header only when nothing legitimate is blocked.
Test the headers
- Open the site, press F12, go to Network, reload and click the page request.
- Check the response headers list.
- Or run
curl -I https://example.comfrom a terminal.
Caching note
Cached pages keep the headers they were stored with. After changing headers, purge LiteSpeed Cache (see LiteSpeed Web Cache Manager).
Troubleshooting
500 error after editing
A typo in the directives. Restore the backup and add lines one at a time (see .htaccess on LiteSpeed).
Site embedded elsewhere stopped working
X-Frame-Options blocks framing by other domains. Use a CSP frame-ancestors rule that allows the specific domain instead.
Frequently asked questions
Do security headers improve SEO?
Not directly. They protect visitors and are checked by security scanners; HTTPS itself is a ranking signal.
Can a WordPress plugin add these instead?
Yes, several plugins do. Use one method only, so headers are not sent twice with conflicting values.
Is X-XSS-Protection still needed?
No. Modern browsers ignore it; Content-Security-Policy is the current approach.
How do I check my headers online?
Free header-checking tools grade your site and list missing headers. Use them after each change to confirm the result.
Do headers apply to addon domains?
Only if the rules are in that domain's own .htaccess file or a parent folder the domain's document root sits in.