Hosting Rules and Security Plugins
Assign the header output to web server, CDN or security plugin first. An additional rule in the theme is not automatically effective for all response types.
A security plugin can complement headers, while hosting or CDN already delivers other values. Check the final answer for conflicting or duplicate defaults before activating another plugin feature.
Where to check the setting in WordPress
Check the response headers outside of a logged-in session and compare Origin and upstream CDN. Headers are not set by a text field in the post. For changes to hosting rules, the actual server or proxy configuration must be responsible.
Example of this specific finding
Illustrative control case: An audit reports missing protective headers. Whether a frame lock is suitable depends on whether the page should be consciously embedded.
follow-up audit in WordPress
Test frontend, login and embedded content separately. Do not adopt a blanket blocking rule that interrupts the required functions of the installation.
For each header, determine protection goals and affected responses. First compare a content security policy with the actually required resources and test functions.
Derogations and scope
Blindly copied headers can damage embeddings, payment or scripts. The number of headers set is not an independent proof of quality.
Related: WordPress with classic or block theme. SEO plugins and page builders are different; there is no universal menu path for all installations.
Classify the general error
Definition, system-independent causes and further correction examples: Configure each header according to its protective task