Security headers that do work

Security headers are HTTP response instructions that tell the browser how to treat your site. They reduce common client-side risks when HTTPS is already solid, but they are not a firewall and they will not stop a compromised plugin. On LogicWeb shared hosting you can set them in LiteSpeed or a small .htaccess file you understand, then confirm with a simple curl check.

Which headers are worth enabling

Start with headers that are cheap and rarely break checkout. Use Strict-Transport-Security only after HTTPS works everywhere on the site, and begin with a short max-age so you can reverse course if something is wrong. Add X-Content-Type-Options: nosniff so the browser does not guess content types. Set Referrer-Policy to something like strict-origin-when-cross-origin unless you have a clearer need. Use X-Frame-Options, or the CSP frame-ancestors directive, if you do not intend the site to load inside someone else’s frame. Permissions-Policy can turn off camera, microphone, and similar features you never use.

Content-Security-Policy is the most useful and the easiest to get wrong. Begin with Content-Security-Policy-Report-Only, watch the reports for a week, then enforce a policy that names the hosts you actually need. A policy that blocks your payment script often gets widened to wildcards in a hurry, and that is weaker than no CSP at all. Headers are not Imunify360 or a WAF. They will not remove a webshell or replace patching.

Check what you already send

Before you add anything, see which headers the server already returns. Duplicate values, especially two different HSTS max-age settings, leave the browser with a story you did not test.

curl -sI https://example.com | grep -iE ‘content-security|strict-transport|x-frame|x-content|referrer’

If LiteSpeed Cache or another plugin already sends a header, do not stack a second copy in .htaccess. Pick one place you can read and maintain. Write the headers down, purge the cache, run curl again, and keep the list short on purpose.

Add them without stacking plugins

On cPanel with LiteSpeed, enable the headers you need in the cache plugin or in a small .htaccess block you control. Avoid five security plugins that each inject the same lines. After a change, purge LiteSpeed, retest with curl, and confirm AutoSSL or your certificate still serves clean HTTPS before you raise HSTS max-age.

Least privilege for users and keys is a separate layer from response headers. Finish the headers you mean to keep, then update the old plugin or theme that still needs attention. A clean scan grade means the browser received instructions. The application still has to be maintained.