Check selected browser defenses
Review findings for missing headers associated with HTTPS behavior, content handling, framing and referrer information.
WordPress security with Sentinel
Find missing WordPress security headers across your sites
Browser protections are easy to overlook when the website appears to work. Sentinel checks selected security headers and groups missing defenses into one finding, helping you prioritize improvements without treating every missing header as a hack.
For connected WordPress websites. Review current availability on plans and features.
Updated
The quick answer
Which security headers should I check on WordPress?
Review Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy in the context of your site. Sentinel checks for selected missing headers and groups them into a website finding. It does not automatically design, install or validate a complete header policy.
What you get
Security header checks in WPCentrify
Avoid a wall of minor alerts
Missing headers are grouped so you can review the website rather than manage a separate task for each header.
Plan a compatible policy
Use the finding as a starting point for a host or developer review, then test forms, embeds and scripts after a change.
Missing security headers do not prove a website is hacked
Security headers instruct a browser how to handle parts of a response. A missing header can mean an extra defense is absent. It is different from a confirmed infection, a vulnerable plugin or an unauthorized administrator.
Sentinel keeps missing-header findings in proportion to that risk. Fix urgent malware findings and known exposures first, then address browser protections as part of ongoing WordPress hardening.
What the selected headers help you review
HSTS concerns HTTPS use. Content-Security-Policy can restrict where browser resources load from. X-Content-Type-Options reduces content-type guessing. X-Frame-Options controls framing, while Referrer-Policy controls what referrer information is shared. The correct values depend on the website and other controls already present.
Presence is only a first check. A header can exist with a weak, conflicting or inappropriate value, and a missing legacy header can be covered by a different policy. Sentinel does not claim that this check certifies the complete browser security configuration.
Add security headers without breaking the website
A strict policy copied from another website can block payment services, embeds, analytics, fonts or application scripts. Ask the host or developer to design the policy for the actual resources your site needs, then test it in a controlled change.
Review the live response after deployment, including CDN behavior. A challenge or error page may have different headers from the website itself. Keep uptime monitoring and normal functional checks alongside the header review so a security change does not hide a broken visitor journey.
Your next steps
How to use security header checks
Review the website finding
Identify which selected headers were missing from the response Sentinel could inspect.
Choose the right configuration
Ask your host or developer to account for scripts, embeds, payment services and existing policies.
Test the live behavior
Check normal website features and the response after the change, then review the next completed check.
Common questions
Security header checks questions answered
Does Sentinel add security headers to WordPress automatically?
No. This feature checks selected headers and reports missing defenses. Your host or developer applies and tests the appropriate policy.
Which WordPress security headers does Sentinel check?
The selected checks include Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy.
Does a missing Content-Security-Policy mean my site is hacked?
No. It means that browser defense was not observed by the check. Investigate actual infection evidence separately.
Can adding a Content-Security-Policy break WordPress features?
Yes. An unsuitable policy can block required resources. Test forms, embeds, payments and scripts with a configuration designed for the website.
Does passing a header check prove my site is secure?
No. Header presence does not validate every policy value, every page or the website as a whole. Keep malware, vulnerability and account checks in place.
Should I use the same security headers on every WordPress website?
The same review process can help across sites, but policy values need to reflect each website's requirements and existing protections.
Related WordPress security features
Security hardening
Apply and verify protection controls
Explore this featureExposed file checks
Check selected public file risks
Explore this featureWordPress firewall
Review and block malicious requests
Explore this featureSee all Sentinel security features or follow the WordPress portfolio security guide.
WPCentrify Sentinel
Give every website a security review you can act on
Bring security findings, protection status and website maintenance into the same dashboard.