Häufig gestellte Frage

Zuletzt aktualisiert vor 15 Tagen

Analyse (mini): https://securityheaders.com/
Analyse (detailliert): https://webbkoll.dataskydd.net
Blogbeitrag: https://www.roundaboutweb.net/sicherheit/security-headers-fuer-wordpress-einrichten/

Eintragung in .htaccess:

Stand August 2026:

Header set Content-Security-Policy "object-src 'none'; base-uri 'none'; form-action 'self'; worker-src 'self' blob:; font-src 'self' https://fonts.gstatic.com data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://cdn.jsdelivr.net https://stats.wp.com https://js.hcaptcha.com; frame-src 'self' https://newassets.hcaptcha.com;frame-ancestors 'self' https://newassets.hcaptcha.com; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com; img-src 'self' data: https://s.w.org https://ps.w.org https://secure.gravatar.com https://www.elegantthemes.com https://rcb.devowl.io https://pixel.wp.com; connect-src 'self' https://maps.googleapis.com https://sourcemap.devowl.io https://yoast.com https://www.elegantthemes.com https://*.w.hcaptcha.com https://newassets.hcaptcha.com;"

Stand Oktober 2025:

### 21.10.2025 | Round About WEB | Header Security ###
<IfModule mod_headers.c>
Header set Access-Control-Allow-Methods "GET,POST"
Header set Access-Control-Allow-Headers "Content-Type, Authorization"
Header set Content-Security-Policy "default-src 'none'; object-src 'none'; base-uri 'none'; form-action 'self'; worker-src blob:; font-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; img-src 'self' data: https://s.w.org https://ps.w.org https://secure.gravatar.com; connect-src 'self' https://sourcemap.devowl.io"
Header set Cross-Origin-Embedder-Policy "unsafe-none; report-to='default'"
Header set Cross-Origin-Embedder-Policy-Report-Only "unsafe-none; report-to='default'"
Header set Cross-Origin-Opener-Policy "unsafe-none"
Header set Cross-Origin-Opener-Policy-Report-Only "unsafe-none; report-to='default'"
Header set Cross-Origin-Resource-Policy "cross-origin"
Header set Permissions-Policy "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=*, publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=*, usb=(), xr-spatial-tracking=(), gamepad=(), serial=()"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" "expr=%{SERVER_PORT} == 443"
Header set X-Content-Security-Policy "default-src 'self'; img-src *; media-src * data:;;"
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Permitted-Cross-Domain-Policies "none"
Header set X-XSS-Protection "1; mode=block"
</IfModule>
# END Headers Security

Stand 16.05.2019:

### 16.05.2019 | Round About WEB | Security Headers ### 
<ifmodule mod_headers.c> 
Header set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" 
Header set Referrer-Policy "same-origin" 
Header set X-XSS-Protection "1; mode=block"
Header set x-frame-options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set Feature-Policy "none"
Header set Content-Security-Policy "self"
Header set Permissions-Policy "accelerometer=(), autoplay=(self), camera=(), encrypted-media=(), fullscreen, geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), midi=(); payment=(), picture-in-picture=('self'), usb=()"
</ifmodule>