KakapoWPKakapoWP
Log inTry for free
Kakapo Security

Security headers

Four lines the browser takes seriously.

Kakapo Security hooks into send_headers and sets four protective headers in the frontend. They tell the browser what it must not do with your website: embed it, guess file types, pass on too much origin.

Try it free for 24 hoursAll Security features

Security headers

X-Frame-Options against embedding by others · nosniff against MIME guessing

ActiveSettings

What security headers offer

X-Frame-Options against foreign embedding
nosniff against MIME sniffing
Referrer-Policy set sparingly
CSP with upgrade-insecure-requests

Here's how it works

1

Turn on header protection

2

send_headers extends the response

3

The browser sticks to them

FAQ about security headers

Which headers are sent?
X-Frame-Options, X-Content-Type-Options with nosniff, Referrer-Policy with strict-origin-when-cross-origin and a simple Content-Security-Policy with upgrade-insecure-requests.
Can a CSP break my site?
The bundled policy is deliberately kept simple and mainly sets upgrade-insecure-requests. Even so, take a look at your site in the frontend once you have switched it on.
Where do the headers apply?
In the frontend. They are set via send_headers, that is, when your pages are delivered to the browser.

More security features

Hardening →Bad request filter →Malware scan →
Ready?

Try Security free for 24 hours.

No credit card, no risk. Up and running in 2 minutes.

Try it for free now