Adding CSP (Content Security Policy) headers to Wordpress

Question How can I add Content Security Policies to a WordPress installation? Answer Locate the functions.php file for your WordPress theme. Open functions.php with your favorite editor and add the following code: function add_custom_security_headers() { header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload"); header("Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.cdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:"); header("X-Frame-Options: SAMEORIGIN"); header("X-Content-Type-Options: nosniff"); header("Permissions-Policy: geolocation=(), microphone=()"); header("Referrer-Policy: no-referrer-when-downgrade"); } add_action('send_headers', 'add_custom_security_headers'); Save the file.