I am facing a problem that both me and my host support team were unable to untangle. I have included security headers in my .htaccess file (see below), but I get inconsistent results:

I am using the W3 Total Cache plugin, but configured as "Disk: Basic" and set to not set any additional caching policy (indeed, unlike before, nothing else appears in the .htaccess file). I am also using Cloudflare as CDN through W3TC.

I am also using "Jetpack" and "Really Simple SSL" among other plugins, but Jetpack is configured with every 'Performance' setting off, and Really Simple SSL does not seem to matter if I turn it on and off.

Clearly it's some Wordpress shenaningan, but which one? I genuinely do not understand, I'd appreciate if anyone had any suggestion!

In my .htaccess file I have put this:

# Really Simple SSL
<IfModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS 
Header set Content-Security-Policy "upgrade-insecure-requests"
Header set X-XSS-Protection "0"
Header set X-Content-Type-Options "nosniff"
Header set Referrer-Policy "strict-origin-when-cross-origin" 
Header set X-Frame-Options "SAMEORIGIN"
Header set Permissions-Policy "geolocation=(); midi=();notifications=();push=();sync-xhr=();accelerometer=(); gyroscope=(); magnetometer=(); payment=(); camera=(); microphone=();usb=(); xr=();speaker=(self);vibrate=();fullscreen=(self);" 
Header set Feature-Policy "camera 'none'; fullscreen 'self'; geolocation *; microphone 'self' 
# End Really Simple SSL
  • 1
    Have you tried without Jetpack, W3TC and Cloudflare? You only mentioned turning off Really Simply SSL. Oct 23, 2023 at 12:09
  • Yes, I've tried that too and it did not seem to matter. However, I need those plugins so if one of them were the issue I'd need to figure out an alternative or a change to their settings... Oct 23, 2023 at 12:12

2 Answers 2


*The below only temporarily solves the issues. I ran into the missing header issues was a new cache file was generated.

I use several of the plugins you mentioned and recently noticed the same issue which drove me crazy as I manually confirmed that all of the headers were present in the correct files. I was able to resolve the issue by deleting my cache in WP Super Cache and confirmed that everything was back to working as expected by running a followup scan on SecurityHeaders.

  • Unfortunately resetting my cache doesn't seem to do the trick for me, but I'm glad it did for you. But I just tested again and now it works?!?!?! Nov 14, 2023 at 22:36

I haven't changed anything significant, but all the headers (as of today) show up and I get A+ reports from those websites.

However, several plugins were updated in the past weeks, so one of the updates must have done it.

All's well that ends well!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.