Security headers set in .htaccess not taking effect on WordPress site with Cloudflare

Question

We have a site on WPEngine that uses WP Rocket cache and Cloudflare where I have added security header directives in the .htaccess file,

<IfModule mod_headers.c>
    # X-XSS-Protection
    Header set X-XSS-Protection "1; mode=block"
    # X-Content-Type nosniff
    Header set X-Content-Type-Options nosniff
    # Content-Security-Policy
    Header set Content-Security-Policy "default-src https:; font-src https: data:; img-src https: data:; script-src https:; style-src https:;"
    # Strict-Transport-Security
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    <filesMatch ".(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf)$">
        Header set Cache-Control "max-age=84600, public"
    </filesMatch>
</IfModule>

This was added a week ago and I have clear all the caches twice since then, but still on securityheaders.com the site receives an 'F'. What can be done to make these security headers take effect?

Answer 1

Since you are already using Cloudflare, an alternative is to use the transform rules to configure what you need.

1. Go to your site's dashboard in CloudFlare
2. Go to Access Rules >>> Transform Rules
3. Click on Managed Transforms
4. Enable the Add Security Headers

You can add other manual headers in that section if you need them.