Title: savvylearner's Replies | WordPress.org

---

# savvylearner

  [  ](https://wordpress.org/support/users/savvylearner/)

 *   [Profile](https://wordpress.org/support/users/savvylearner/)
 *   [Topics Started](https://wordpress.org/support/users/savvylearner/topics/)
 *   [Replies Created](https://wordpress.org/support/users/savvylearner/replies/)
 *   [Reviews Written](https://wordpress.org/support/users/savvylearner/reviews/)
 *   [Topics Replied To](https://wordpress.org/support/users/savvylearner/replied-to/)
 *   [Engagements](https://wordpress.org/support/users/savvylearner/engagements/)
 *   [Favorites](https://wordpress.org/support/users/savvylearner/favorites/)

 Search replies:

## Forum Replies Created

Viewing 3 replies - 1 through 3 (of 3 total)

 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] Missing security headers SSL](https://wordpress.org/support/topic/missing-security-headers-ssl-2/)
 *  [savvylearner](https://wordpress.org/support/users/savvylearner/)
 * (@savvylearner)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/missing-security-headers-ssl-2/#post-13719801)
 * UPDATE
 * I fine-tuned my policy following [https://developers.google.com/web/fundamentals/security/csp#use_case_3_ssl_only](https://developers.google.com/web/fundamentals/security/csp#use_case_3_ssl_only).
   Now the site-health page loads, but doesn’t show the statistics as some resources
   are still blocked (e.g. use of `eval()` in JavaScript). Is there a way to use
   the header `Content-Security-Policy` without breaking something in WordPress?
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] Missing security headers SSL](https://wordpress.org/support/topic/missing-security-headers-ssl-2/)
 *  [savvylearner](https://wordpress.org/support/users/savvylearner/)
 * (@savvylearner)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/missing-security-headers-ssl-2/#post-13718279)
 * UPDATE.
 * I found one problem. Apache wasn’t parsing `.htaccess`. I solved it by modifing`/
   opt/bitnami/apps/wordpress/conf/httpd-app.conf` (`AllowOverride None --> AllowOverride
   All`). I checked on `securityheaders.com` and it worked.
 * However, the “recommended improvement” message on my site-health page was still
   there. I noticed that the header `Content-Security-Policy` was missing from [https://really-simple-ssl.com/site-health-recommended-security-headers/](https://really-simple-ssl.com/site-health-recommended-security-headers/).
   Thus, I added `Header set Content-Security-Policy "default-src 'self';"` to my`.
   htaccess` but that disabled JavaScript on my website. Do you have any tip for
   me at this point? Thanks!
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] Missing security headers SSL](https://wordpress.org/support/topic/missing-security-headers-ssl-2/)
 *  [savvylearner](https://wordpress.org/support/users/savvylearner/)
 * (@savvylearner)
 * [5 years, 8 months ago](https://wordpress.org/support/topic/missing-security-headers-ssl-2/#post-13717169)
 * Hi [@markwolters](https://wordpress.org/support/users/markwolters/) ,
 * I added
 *     ```
       # BEGIN Really Simple SSL
       Header always set Strict-Transport-Security: "max-age=31536000" env=HTTPS
       Header always set X-Content-Type-Options "nosniff"
       Header always set X-XSS-Protection "1; mode=block"
       Header always set Expect-CT "max-age=7776000, enforce"
       Header always set Referrer-Policy: "no-referrer-when-downgrade"
       # END Really Simple SSL
       ```
   
 * at the top of my .htaccess file in /opt/bitnami/apps/wordpress/htdocs , but the“
   recommended improvement” message doesn’t go away. Also `securityheaders.com` 
   shows that the headers added above aren’t active. What is the problem?

Viewing 3 replies - 1 through 3 (of 3 total)