Check security headers, HTTPS, and DMARC

Which security headers a website should send, how to read them in your browser, the headers this site sends, and how SPF, DKIM, and DMARC protect your email.

Key points

Security headers tell the browser how to treat your site, for example to load it only over HTTPS. You can read them in any browser.
A Content Security Policy is the main defense against cross-site scripting, where an attacker gets their own script into your pages.
SPF, DKIM, and DMARC show that email from your domain really comes from you. Since February 2024, Gmail has required bulk senders to authenticate their email.

How to see your headers

Every web server sends headers along with each page. To read them:

In the browser: open the developer tools (F12 in most browsers), go to the tab Network, reload the page, click the first entry, and look at the response headers.
In a terminal: curl -I https://example.com shows the headers of your home page.

The headers this site sends

These are the security headers crackthe.net sends on every page:

Header	What it does	Value on this site
Strict-Transport-Security	tells browsers to use only HTTPS for the site and to turn every HTTP request into HTTPS; users cannot click through certificate errors	max-age=31536000; includeSubDomains (one year, subdomains included)
Content-Security-Policy	lists the sources from which the page may load scripts, styles, and images; the main defense against cross-site scripting, and with frame-ancestors also against clickjacking	default-src ’none’, then a short list of allowed sources
X-Content-Type-Options	stops the browser from guessing a file’s type	nosniff
X-Frame-Options	stops other sites from showing the page in a frame	DENY
Referrer-Policy	controls how much of the address other sites see when a visitor follows a link	strict-origin-when-cross-origin
Permissions-Policy	turns off browser features the site does not use, such as the camera	camera=(), microphone=(), and more

A strict Content Security Policy is the hardest of these to set up on WordPress, because themes and plugins often load scripts from other domains. Start with the other headers. Your host, a firewall in front of the site, or a plugin can add them.

HTTPS

Every page should load over HTTPS, with a valid certificate. Strict-Transport-Security makes sure the browser does not fall back to plain HTTP. Start with a short duration (max-age): once browsers have seen the header, they keep using HTTPS for the time it states.

SPF, DKIM, and DMARC for your email

Your site probably sends email: contact forms, orders, password resets. Three entries in your domain’s DNS show receiving mail servers that the email is really yours:

Entry	What it states
SPF	which servers may send email for your domain
DKIM	a signature that proves the email comes from your domain and was not changed on the way
DMARC	what receivers should do with email that fails these checks, and where to send reports

Without them, anyone can send email in your domain’s name more easily, and your own email may land in spam. Since February 2024, Gmail has required senders of more than 5,000 messages a day to Gmail addresses to authenticate their email. To check your DMARC entry, run dig TXT _dmarc.example.com in a terminal, with your domain in place of example.com.

What you can do

Read your headers in the browser and compare them with the table above.
Add the missing simple headers first: X-Content-Type-Options, X-Frame-Options or frame-ancestors, Referrer-Policy, and Permissions-Policy.
Turn on Strict-Transport-Security once every page and subdomain works over HTTPS.
Set up SPF, DKIM, and DMARC for your domain. Your email provider shows the entries to add.
Plan a Content Security Policy last, after you know which outside sources your theme and plugins load.

Next step

The page Web security tools lists the firewalls and security plugins for WordPress.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.