Web Page Test Scores F for Security

Hi Alan,

You can improve this by installing a security plugin. Plugins generally add the necessary security headers to your site so you don't have to manually write it yourself. :D

As for recommendations, the most famous of the bunch is Sucuri or Wordfence.

Hi Elvin

That's strange then because I have already got Wordfence installed. I will check my settings.

Thanks

Alan

No problem. :D

I still haven't managed to solve this issue. I've got wordfence security but there don't appear to any settings in there that will fix this.

I found this on another website but I really would like to know if this is safe

2DogsDesign

It suggests to add this to the .htaccess file

Header always append X-Frame-Options DENY
Header set X-Content-Type-Options nosniff
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
Header always set X-XSS-Protection "1; mode=block"
Header set Content-Security-Policy "script-src 'unsafe-inline' 'unsafe-eval' http: https:"

Is there a better way? I would prefer not to add another plugin if possible

Thanks

Hi there,

best thing would be to speak with your host regarding this, as those are all server level functions. They will be best placed to advise on what 'can/should' be done, and they may already have some prebuilt configs that can be applied to your site.

Thanks David. I have contacted my host about this.

Hope they can help :)