Sau khi WP-SHELLSTORM lây nhiễm 25.000 site WordPress và WordPress 7.0.2 phải vá khẩn cấp 2 lỗ hổng SQL Injection lẫn RCE, mình nhận ra nhiều người chỉ cập nhật core mà bỏ qua một lớp bảo mật quan trọng: HTTP Security Headers. Đây không phải tính năng cao siêu — chi la 6 dong config ma hau het hosting de mo mac dinh. Bai viet nay minh se huong dan ban cau hinh tu A den Z, dat diem A+ tren securityheaders.com trong dung 15 phut.
Security Headers la gi va tai sao WordPress can?
Security Headers la cac HTTP response header bao ve trinh duyen khoi cac tan cong pho bien nhu XSS, clickjacking, MIME sniffing. Khi trinh duyen request mot trang WordPress, server tra ve khong chi HTML ma con cac header bao mat noi day. 95% site WordPress minh kiem tra chi dat 2-3 headers, thieu hoan toan Content-Security-Policy va Permissions-Policy.
Google da xac nhan bao mat website la one of 200 ranking factors. Mot site dat F tren securityheaders.com khong chac bi phat, nhung mot site dat A+ se co loi the nho khi Google danh gia E-E-A-T.
Cach kiem tra diem Security Headers hien tai nhu the nao?
Ban can biet tinh trang hien tai truoc khi sua. Co 3 cach nhanh:
Cach 1 — securityheaders.com: Vao securityheaders.com, nhap domain, nhan Scan. Ket qua tra ve diem tu F den A+ voi danh sach header dang co va dang thieu. Day la cong cu chuan nhat, lap boi Scott Helme.
Cach 2 — Mozilla Observatory: Vao observatory.mozilla.org de kiem tra chi tiet hon, kem theo recommendations cu the.
Cach 3 — WP-CLI: Chay lenh sau de xem header hien tai:
curl -sI https://yourdomain.com | grep -iE "strict-transport|x-frame|x-content|referrer|content-security|permissions"Neu ket qua tra ve it hon 5 dong, site cua ban dang de ho.
6 Security Headers nao WordPress can cau hinh?
Day la 6 headers khong the thieu cho bat ky site WordPress nao:
1. Strict-Transport-Security (HSTS): Ep trinh duyen luon dung HTTPS, chan attack downgrade HTTP. Sau khi cau hinh, trinh duyen se tu dong chuyen HTTP sang HTTPS khong can redirect.
2. X-Frame-Options: Ngan trang web cua ban bi nhung vao iframe cua site khac (clickjacking). WordPress admin page dac biet can header nay.
3. X-Content-Type-Options: Chan MIME sniffing — trinh duyen khong duoc doan kieu file khac voi Content-Type ma server gui. Ngan attack upload file gia mao.
4. Referrer-Policy: Dieu khien thong tin Referrer duoc gui khi user click link ra ngoai. Gia tri strict-origin-when-cross-origin la tot nhat cho 2026.
5. Content-Security-Policy (CSP): Header quan trong nhat va phuc tap nhat. Noi server cho phep tai script, style, image tu dau. Ngan chinh xac XSS attack.
6. Permissions-Policy: Bat/tat cac API cua trinh duyen nhu camera, microphone, geolocation. WordPress khong can hau het cac API nay, nen tat het de giam rủi ro.
Cau hinh Security Headers cho Nginx nhu the nao?
Neu ban dung VPS hoac server rieng voi Nginx (pho bien nhat cho WordPress 2026), day la config day du. Mo file config cua site:
sudo nano /etc/nginx/sites-available/yourdomain.comThem vao block server { ... }, ngay sau dong listen 443 ssl:
# Security Headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https: data:; connect-src 'self' https:; frame-src 'self' https:; object-src 'none'; base-uri 'self'; form-action 'self';" always;Luu y: Dong always cuoi moi header dam bao header duoc gui ca khi server tra loi 4xx/5xx. Kiem tra config:
sudo nginx -t
sudo systemctl reload nginxVe CSP, bat dau voi 'unsafe-inline' va 'unsafe-eval' de WordPress hoat dong binh thuong. Sau khi site on dinh, ban co the siết lai bang nonce hoac hash de loai bo unsafe-inline — nhung day la buoc nang hon, minh se noi o phan loi thuong gap.
Cau hinh Security Headers cho Apache va .htaccess?
Neu ban dung shared hosting hoac Apache, them vao file .htaccess o thu muc goc WordPress:
# Security Headers
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https: data:; connect-src 'self' https:; frame-src 'self' https:; object-src 'none'; base-uri 'self'; form-action 'self';"
</IfModule>Luu file lai. Apache khong can restart, thay doi co hieu luc ngay. Kiem tra mod_headers da duoc bat:
a2enmod headers
systemctl restart apache2Tren shared hosting (cPanel, DirectAdmin), mod_headers thuong da bat san. Neu header khong xuat hien sau khi them, lien he hosting provider.
Cau hinh Security Headers qua Cloudflare nhu the nao?
Neu ban dang dung Cloudflare (minh da huong dan Cloudflare Cache Response Rules truoc day), ban co the them Security Headers ngay trong Cloudflare Dashboard khong can sua server:
Steps:
- Vao Cloudflare Dashboard → chon domain
- Security → Headers
- Bat HTTP Strict Transport Security (HSTS)
- An Add custom header de them 5 headers con lai
Cach nay co loi la: header duoc them o edge level, khong anh huong server. Nhuoc diem: ban phoi hop ca server header va Cloudflare header — chon 1 trong 2 de tranh duplicate.
Cau hinh Security Headers cho OpenLiteSpeed?
OpenLiteSpeed ngay cang pho bien cho WordPress nho toc do xung hon Nginx. Cau hinh header qua Virtual Host config:
sudo nano /usr/local/lsws/conf/vhosts/yourdomain/vhconf.confThem vao section context /:
extraHeaders Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
extraHeaders X-Frame-Options "SAMEORIGIN"
extraHeaders X-Content-Type-Options "nosniff"
extraHeaders Referrer-Policy "strict-origin-when-cross-origin"
extraHeaders Permissions-Policy "geolocation=(), microphone=(), camera=()"
extraHeaders Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https: data:; object-src 'none';"Restart OpenLiteSpeed:
sudo systemctl restart lswsLuu y: Neu ban dung CyberPanel, vao Web Admin → Virtual Hosts → Context → them extraHeaders qua giao dien.
Kiem tra lai sau khi cau hinh nhu the nao?
Sau khi reload server, quay lai securityheaders.com va scan lai. Neu ban lam dung, diem se la A hoac A+.
De dat A+, ban can them them 2 thong so:
- HSTS Preload: Submit domain tai hstspreload.org de duoc Google Chrome va Firefox nhung vao danh sach preload.
- CSP nonce hoac hash: Thay
'unsafe-inline'bang nonce dong cho moi request.
Kiem tra bang WP-CLI:
curl -sI https://yourdomain.com | grep -iE "strict-transport|x-frame|x-content|referrer|content-security|permissions" | wc -lKet qua phai la 6. Neu it hon, ban da bo header nao do.
Cau hinh CSP cho WooCommerce dac biet nhu the nao?
WooCommerce can them mot so connect-src cho payment gateway. Neu ban dung Stripe, PayPal, cen MOT gioi thanh toan, CSP can mo rong:
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com https://www.paypal.com; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; connect-src 'self' https://api.stripe.com https://www.paypal.com; frame-src 'self' https://js.stripe.com https://www.paypal.com; object-src 'none';"Nguyen tac: Chi mo domain cua payment provider ma ban thuc su dung. Dung mo * vi se mat hoan toan y nghia cua CSP.
Loi thuong gap khi cau hinh Security Headers?
Loi 1 — Backend bi chan vi CSP: Plugin can goi API ngoai (Google Analytics, Facebook Pixel) nhung CSP chan. Fix: them domain vao connect-src va script-src. Vi du: script-src 'self' 'unsafe-inline' https://www.googletagmanager.com.
Loi 2 — Inline style bi vo hieu hoa: WordPress core va theme su dung nhieu inline style. Neu bo 'unsafe-inline' khoi style-src, giao dien se vo. Fix: bat dau voi 'unsafe-inline', roi chuyen sang nonce sau.
Loi 3 — Admin area bi vo hieu hoa: WordPress admin su dung iframe (vi du Media Library). Dam bao X-Frame-Options dat SAMEORIGIN, khong dat DENY.
Loi 4 — Duplicate headers: Neu ban cau hinh header o ca server va Cloudflare, trinh duyen nhan duplicate. Chon mot noi de cau hinh, khong ca hai.
Loi 5 — HSTS preload khong the hoan tac: Khi da submit vao HSTS preload list, viec go ra khoi danh sach mat tu 30 ngay den 6 thang. Chi preload khi ban chac chan se khong bao gio bo HTTPS.
Co nen dung plugin WordPress de cau hinh Security Headers?
Co mot so plugin nhu HTTP Headers hoac Security Headers by WP Socket tren wordpress.org. Tuy nhien, minh khong khuyen dung plugin cho viec nay. Ly do: header processing o PHP level cham hon o web server level, va neu WordPress bi crash, header cung bien mat theo.
Cau hinh truc tiep tren Nginx, Apache, hoac Cloudflare la 0ms overhead va hoat dong ngay ca khi PHP fatal error.
Neu ban khong co quyen sua server config (shared hosting), .htaccess la phuong an tot nhat. Tren shared hosting Apache, .htaccess hoat dong o web server level, khong phai PHP level.
Security Headers anh huong nhu the nao den Core Web Vitals?
Security Headers khong anh huong truc tiep den LCP, CLS, hay INP. Tuy nhien, Strict-Transport-Security giup giam 1 round-trip moi khi user truy cap lan dau — vi trinh duyen khong can redirect HTTP sang HTTPS. Tren mobile 3G, day la tiet kiem 200-400ms.
Permissions-Policy tat cac API khong can thiet giup giam JavaScript execution time cua third-party scripts, cai thien INP gian tiep.
Content-Security-Policy chan third-party scripts khong duoc uy quyen, giam tong so request va JavaScript payload.
Ket hop voi huong dan toi uu toc do WordPress 2026 cua minh, ban se co mot site vua nhanh vua bao mat.
Ket luan
Security Headers la lop bao mat co ban nhat ma 90% site WordPress bo qua. Chi 6 dong config, ban da them mot lop bao ve chung chong XSS, clickjacking, MIME sniffing, va downgrade attack. Khi ket hop voi WordPress 7.0.2 security release va kiem tra webshell WP-SHELLSTORM, site WordPress cua ban sedat chuan bao mat 2026.
Qui trinh nhanh:
- Kiem tra diem hien tai tai securityheaders.com
- Chon server: Nginx, Apache, Cloudflare, hoac OpenLiteSpeed
- Copy 6 headers config vao
- Reload server
- Scan lai de xac nhan diem A hoac A+
- Neu dung WooCommerce, mo rong CSP cho payment gateway
Mat 15 phut, nhan A+ bao mat. Khong co ly do gi de chua lam ngay hom nay.
