Title: Security headers not working
Last modified: March 12, 2019

---

# Security headers not working

 *  Resolved [tanckom](https://wordpress.org/support/users/tanckom/)
 * (@tanckom)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/)
 * I’ve enabled all security headers and none are enabled on the page using this
   tool:
    [https://securityheaders.com/](https://securityheaders.com/) to check.
 * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fsecurity-headers-not-working%2F%3Foutput_format%3Dmd&locale=en_US)
   to see the link]_

Viewing 10 replies - 1 through 10 (of 10 total)

 *  Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/)
 * (@nintechnet)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11304354)
 * You have an issue with your site or webserver configuration. No headers is returned.
   
   Also it seems you have another security application running, so make sure it 
   does not remove the headers but forward them as expected:
 *     ```
       $ curl  https://advena.me/
       <h1>Security incident detected</h1><p>Your request was blocked. Please try again later (or don't).</p>
       ```
   
 *  Thread Starter [tanckom](https://wordpress.org/support/users/tanckom/)
 * (@tanckom)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11306878)
 * I’ve removed the security plugin and made sure NinjaFirewall is running.
    But
   I’m only not seeing the headers using this tool: [https://securityheaders.com/?q=https%3A%2F%2Fadvena.me&followRedirects=on](https://securityheaders.com/?q=https%3A%2F%2Fadvena.me&followRedirects=on)
 *  Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/)
 * (@nintechnet)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11308445)
 * Can you try the following code:
 *     ```
       <?php
       header('Content-Type: text/plain');
       header('X-Content-Type-Options: nosniff');
       header('X-Frame-Options: SAMEORIGIN');
       header('X-XSS-Protection: 1; mode=block');
       header('Referrer-Policy: strict-origin' );
       ```
   
 * 1. Save it to a file named ‘header.php’.
    2. Over FTP, upload the file into your
   document root folder. 3. Go to securityheaders.com, and enter `https://advena.
   me/header.php` as the URL, so that it will test that script only.
 * Does it work?
 *  Thread Starter [tanckom](https://wordpress.org/support/users/tanckom/)
 * (@tanckom)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11308647)
 * Done and that one works. But what about the rest of the website?
 *  Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/)
 * (@nintechnet)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11312144)
 * That’s odd, there must be a configuration issue somewhere.
    - Do you see any error in the NinjaFirewall “Overview” page?
    - Do you see any error in the “Firewall Policies > Advanced Policies” section?
    - Are you running the firewall in “Full WAF” or “WordPress WAF” mode ? (You 
      can see which mode you are using in the “Overview” page.)
 *  Thread Starter [tanckom](https://wordpress.org/support/users/tanckom/)
 * (@tanckom)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11312194)
 * 1. Overview page are no errors: [https://imgur.com/Jms1gLP](https://imgur.com/Jms1gLP)
   
   2. No errors on Firewall Policies [https://imgur.com/wDJRhCf](https://imgur.com/wDJRhCf)
   3. And I’m running “Full WAF”
 *  Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/)
 * (@nintechnet)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11316880)
 * Do you have a caching plugin installed? It would serve the cached index page,
   but without the security headers.
 *  Thread Starter [tanckom](https://wordpress.org/support/users/tanckom/)
 * (@tanckom)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11317571)
 * I have and disabled it. The results are still the same. :/
    -  This reply was modified 7 years, 1 month ago by [tanckom](https://wordpress.org/support/users/tanckom/).
 *  Plugin Author [nintechnet](https://wordpress.org/support/users/nintechnet/)
 * (@nintechnet)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11318773)
 * I think it has to come from the caching plugin: check your .htaccess. Even if
   you disabled it, it may have left some rules inside your .htaccess.
 *  Thread Starter [tanckom](https://wordpress.org/support/users/tanckom/)
 * (@tanckom)
 * [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11348952)
 * Well thanks for the hint, it looked like NinjaFirewall didn’t have access to 
   my .htaccess file and I manually injected the
    # BEGIN NinjaFirewall php_value
   auto_prepend_file …/wp-content/nfwlog/ninjafirewall.php # END NinjaFirewall
 * Script. You sir are a treat, keep going the good work!

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘Security headers not working’ is closed to new replies.

 * ![](https://ps.w.org/ninjafirewall/assets/icon-256x256.png?rev=976137)
 * [NinjaFirewall (WP Edition) - Advanced Security Plugin and Firewall](https://wordpress.org/plugins/ninjafirewall/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/ninjafirewall/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/ninjafirewall/)
 * [Active Topics](https://wordpress.org/support/plugin/ninjafirewall/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/ninjafirewall/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/ninjafirewall/reviews/)

 * 10 replies
 * 2 participants
 * Last reply from: [tanckom](https://wordpress.org/support/users/tanckom/)
 * Last activity: [7 years, 1 month ago](https://wordpress.org/support/topic/security-headers-not-working/#post-11348952)
 * Status: resolved