Supplies baseline HTTP security headers.
Capabilities and extension points
Adds baseline security headers to WordPress responses reaching send_headers.
Headers are skipped if the response headers have already been sent.
Registers hooks for sending security headers.
Sends the security response headers.
Gets validated security response headers for the current request.
- return array Header values keyed by header name.
Filters per-request security header policies.
Omitted keys retain their defaults. Use an explicit null value to omit one header, for example when a server owns that policy. Invalid values retain the default. Additional headers such as CSP are supported.
- param array $headers Header values keyed by name; null omits a header.
- param Headers $sender Security header instance.
Source reference
This editable reference page is based on the PHP documentation in security/class-headers.php.