2023-01-20
WordPress is widely used on the web, and for that reason it's a big target for hackers. WordPress contains some security features, but also leaves some holes open for exploitation.
To tighten up WordPress security and to prevent cross site scripting attacks, content injection, clickjacking, and MIME sniffing, additional works need to be done. The security can be improved by updating the HTTP headers WordPress sets. Below is a collection of improvements in one code snippet. Hope you find them helpful and happy coding.
<?php
/**
* This code should go into functions.php
*/
// Define helper functions
/**
* Changes default WordPress headers to a custom ones
*/
function change_cors_headers() {
remove_filter( 'rest_pre_serve_request', 'rest_send_cors_headers' );
add_filter( 'rest_pre_serve_request', 'send_cors_headers' );
}
/**
* Set Content-Security-Policy header,
* sets default source for all objects to the existing site
* restricts the use of content in embeded objects to the same origin
*/
function send_content_security_policy() {
header( 'Content-Security-Policy: default-src \'self\'; frame-ancestors \'self\';' );
};
/**
* Update the CORS headers to be restricted to the existing domain
*/
function send_cors_headers($value) {
$origin = get_http_origin();
$site_domain = $_SERVER['SERVER_NAME'];
if ( $origin ) {
// Requests from file:// and data: URLs send "Origin: null".
if ( 'null' !== $origin ) {
$origin = esc_url_raw( $origin );
}
header( 'Access-Control-Allow-Origin: ' . $site_domain );
header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
header( 'Access-Control-Allow-Credentials: true' );
header( 'Vary: Origin', false );
} elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
header( 'Vary: Origin', false );
}
return $value;
}
/**
* Set permission policy header for default features
*/
function send_permissions_policy() {
header( 'Permissions-Policy: camera=(self), fullscreen=(), geolocation=(self), microphone=(self), payment=(self), publickey-credentials-get=(self), web-share=(self)' );
}
/**
* Restrict the amount of information that is sent with the referrer policy
* include only the minimally necessary information
*/
function send_referrer_policy() {
header( 'Referrer-Policy: strict-origin-when-cross-origin' );
}
// Add actions and filters for all headers
// Update CORS headers, see function above
add_action('rest_api_init', 'change_cors_headers' );
// Disable XMLRPC, as it is no longer in use
add_filter('xmlrpc_enabled', '__return_false');
// Restirct X-Frame-Options to same origin
// `send_frame_options_header` is defined in WordPress core in /wp-includes/functions.php
add_action( 'send_headers', 'send_frame_options_header', 10, 0 );
// Send nosniff header
// `send_nosniff_header` is defined in WordPress core in /wp-includes/functions.php
add_action( 'send_headers', 'send_nosniff_header', 10, 0);
// Set security policy header
add_action( 'send_headers', 'send_content_security_policy', 10, 0);
// Set permissions policy header
add_action( 'send_headers', 'send_permissions_policy', 10, 0);
// Set referrer policy header
add_action( 'send_headers', 'send_referrer_policy', 10, 0);