Bluehost Agency: Adding Custom Headers to Your WordPress Site

HTTP headers play a vital role in how your website communicates with your visitors' browsers, affecting everything from security to how content is handled. In this guide, we'll explore what HTTP headers are and show you how to add them to your site effectively.

• What Are HTTP Headers?
• Best Practices and Considerations
• How to add the custom-redirects.php file
• Summary

What Are HTTP Headers?

HTTP headers are directives sent from a web server to a visitor’s browser along with the site’s content. They tell the browser how to process that content—such as enforcing security policies, controlling caching behavior, or providing information about the server itself.

While the Bluehost platform includes strong security defaults, you may still need to add custom headers to satisfy a security scanner’s requirements or to enable advanced features. This guide shows the proper way to implement them using the custom-redirects.php file.

Best Practices and Considerations

• Testing: Be sure to carefully test any changes made via custom-redirects.php, particularly with caching systems like page cache and edge cache. Incorrect configurations may lead to unexpected results or performance issues.
• Performance Impact: Because custom-redirects.php is executed on every request, overusing complex scripts or multiple redirects can negatively impact your site's performance. Always consider performance when using this file.

How to add the custom-redirects.php file

The most reliable way to add custom headers to your site is by using a dedicated file named custom-redirects.php in your site’s root directory (/htdocs). If the file isn’t already there, you can create it—our platform will automatically load it whenever your site runs.

1. Connect to your site using SSH or SFTP, and you should be in /htdocs when you connect.
2. Create or edit the file named custom-redirects.php.
3. Add your custom header functions to this file.

Example Custom Header:

<?php
// Add custom headers to your site.
// Each header should be on its own line.
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('Referrer-Policy: no-referrer-when-downgrade');
header('X-XSS-Protection: 1; mode=block');
?>

Summary

To add custom HTTP headers, simply create or update the custom-redirects.php file in your /htdocs directory using SSH or SFTP, then insert your header rules. As this file executes with every PHP request, we advise you to thoroughly test your modifications to prevent any caching issues or performance problems. If you have any doubts about the steps, our Support team is always available to assist you.