Server utility

HTTP Security Headers Generator

Set up the defensive headers that protect your WooCommerce store against clickjacking, XSS injection and unauthorised downloads.

Strict-Transport-Security (HSTS)Forces secure HTTPS connections and protects against protocol downgrades.

X-Frame-Options (SAMEORIGIN)Prevents clickjacking by stopping your store from loading inside other sites' iframes.

X-Content-Type-Options (nosniff)Stops browsers from interpreting files with the wrong MIME type.

Referrer-Policy (strict-origin-when-cross-origin)Limits the browsing data sent to other sites when visitors leave your domain.

Block .sql, .zip and .bak filesDenies any attempt to download backups left in the web root.

How to apply these rules to your store

1. Apache or LiteSpeed servers: open the .htaccess file in your WordPress root folder and paste the block at the top, before the # BEGIN WordPress section.

2. Nginx servers: add the directives inside the server { ... } block of your configuration file and reload with sudo nginx -t && sudo systemctl reload nginx.

Want to check whether your store already sends these headers?

Try the Melopo Radar scanner: it checks your server's public HTTP headers in seconds.

No sign-up and nothing to install. We look at what anyone can see from outside.