Web security is a key factor in protecting users and preventing attacks like code injections, data theft, or unauthorized access. An effective way to strengthen your site's security is by setting up security headers on the server.
In this article, we'll explain what HTTP security headers are, why they're important, and how to configure them on your website.
In a shared hosting environment, where we don't have access to the server's core configuration, HTTP security headers can be set up using the .htaccess file or with WordPress plugins.
These headers help protect your site from attacks such as:
🔹 Cross-Site Scripting (XSS)
🔹 Clickjacking
🔹 Malicious code injections
🔹 Man-in-the-Middle (MITM) attacks
In this guide, we'll explain how to set them up on a LiteSpeed server with cPanel, what options you have, and how to verify that they are working correctly.
1️⃣ What Are HTTP Security Headers and Why Are They Important?
HTTP security headers are directives sent from the server to the user's browser, telling the web page how to behave in terms of security.
✅ Benefits of setting them up correctly:
✔️ They prevent third parties from injecting malicious code. ✔️ They protect against brute-force and MITM attacks. ✔️ They improve the overall security of your website.
⚠️ Before You Start: Make a Backup
Modifying the .htaccess file or setting up HTTP headers in WordPress is a delicate task. A configuration error could:
❌ Block external scripts
❌ Disable payment gateways
❌ Prevent images and styles from loading
❌ Break key site functionalities
👉 Before making any changes, create a backup of your site and your .htaccess file.
Read the following guide along with this one for more details: Risks of Security Header Configuration | Sered S.L
2️⃣ Methods for Setting Up Headers on Shared Hosting with LiteSpeed
Since we don't have direct access to the server configuration on shared hosting with cPanel and LiteSpeed, we can implement security headers in two ways:
Using the .htaccess file (Recommended for any website, including WordPress).
Using a WordPress plugin (For those who prefer a solution without manually modifying files).
3️⃣ Setting Up Security Headers in .htaccess
The .htaccess file is a powerful tool that allows you to modify server behavior without access to the global configuration.
📌 Locating the .htaccess file in cPanel: 1️⃣ Log in to cPanel. 2️⃣ Go to File Manager > public_html (or your website's folder). 3️⃣ Find the .htaccess file (If you don't see it, make sure to enable "Show Hidden Files"). 4️⃣ Edit it with a text editor and add the following lines depending on the headers you want to activate.
📌 Header 1: Strict-Transport-Security (HSTS) Prevents users from accessing your site via HTTP, forcing HTTPS on all connections.
🔹 Important: This only works if you already have an active SSL certificate on your site. 🔹 Code for .htaccess: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" 🔹 Explanation:
max-age=31536000: Maintains the policy for 1 year (in seconds).
includeSubDomains: Applies the policy to all subdomains.
preload: Allows the domain to be included in the HSTS preload list in browsers.
📌 Header 2: X-Frame-Options Prevents Clickjacking attacks by stopping your site from being loaded in a malicious iframe.
🔹 Code for .htaccess: Header always set X-Frame-Options "SAMEORIGIN" 🔹 Options:
"DENY" → Blocks loading in any iframe.
"SAMEORIGIN" → Only allows loading if the iframe is on the same domain.
📌 Header 3: X-Content-Type-Options Prevents browsers from incorrectly detecting a file's type, which helps stop XSS attacks.
🔹 Code for .htaccess: Header always set X-Content-Type-Options "nosniff" 🔹 Benefit: Prevents the execution of malicious files that are disguised as images or documents.
📌 Header 4: Content-Security-Policy (CSP) This header helps prevent attacks like Cross-Site Scripting (XSS) and malicious content injections.
Next, you can refer to the following guide to see how to configure it correctly: Content-Security-Policy (CSP) | Sered S.L
4️⃣ Setting Up Security Headers in WordPress with a Plugin
If you don't want to edit the .htaccess file manually, you can use a security plugin for WordPress.
✅ Recommended options:
Headers Security Advanced & HSTS WP
HTTP Headers (allows for configuring advanced headers)
iThemes Security (a comprehensive option with more features)
Implement these settings in WordPress and strengthen your website's security! 🚀🔐
5️⃣ How to Verify That the Headers Are Working
To check that the headers are active, use online tools such as:
✅ Security Headers
✅ Mozilla Observatory
✅ Chrome DevTools → "Network" tab > "Headers".
🔄 Verify That Everything Works After applying the changes:
✔️ Test the website and check if everything loads correctly. It's recommended to clear the WP cache. ✔️ Verify the headers with one of the tools above. ✔️ If something breaks, restore the backup and review your configuration.
🔚 Conclusion
Setting up security headers on shared hosting with LiteSpeed and cPanel is possible using .htaccess or WordPress plugins.
The biggest risks come from overly restrictive settings in Content-Security-Policy, X-Frame-Options, and Referrer-Policy.
Configuring headers in .htaccess or with WordPress plugins can improve your site's security and performance. However, any error in the configuration can affect the site's functionality. Therefore, follow these recommendations:
🔹 Always make a backup before modifying .htaccess.
🔹 Verify the changes with tools like Security Headers.
🔹 If something breaks, deactivate the plugin or restore the .htaccess file.