Change or remove HTTP headers added by VIP Go

By default, VIP adds two custom HTTP response headers to every application we host. These headers help us monitor our platform and can be useful when troubleshooting the origin of a request, but they can be removed if necessary.

HTTP headers are part of the HTTP protocol used to request web pages and responses from API endpoints and also to send the response (e.g. the web page or the API response). They are neither visible when viewing web pages in a browser nor when viewing the HTML source for a web page.

HTTP headers added by our platform, along with all other request and response headers, can be inspected by using specific tools, such as cURL. Here is an example of the X-hacker and X-Powered-By HTTP headers added by our platform:

X-hacker: If you’re reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.

X-Powered-By: WordPress VIP <https://wpvip.com>

Headers can be added, edited, or removed using the following functions, which can be placed in a separate plugin, in your theme’s functions.php file, or in a plugin such as Code Snippets.

Remove a header

WordPress core sends over a dozen default headers that can also be removed. For example, to remove wp_generator:

remove_action( 'wp_head', 'wp_generator' );

To alter the custom headers sent by VIP, use the wp_headers filter to unset or modify them as desired. The source code contains the latest header keys and can be used as a reference.

As an example, the following snippet can be used to remove the X-hacker header:

add_filter( 'wp_headers', function( $headers ) {
    unset( $headers['X-hacker'] );
    return $headers;
}, 999 );

Change a header

To change the value of a VIP header, replace the value with a new one. For example:

add_filter( 'wp_headers', function( $headers ) {
    $headers['X-hacker'] = 'Follow the white rabbit over to wpvip.com/careers to join our team.';
    $headers['X-Powered-By'] = 'WordPress VIP, an Automattic Production.';
    return $headers;
}, 999 );

Add a header

There may be scenarios where you want to add your own headers. The wp_headers filter can be used in your theme’s functions.php file for this as well. Be sure to consider the possibility of a header already being set.

add_action( 'wp_headers', function( $headers ) {
    if ( ! isset( $headers['your custom headers here'] ) {
        $headers['your custom header here'] = ‘The header value’;
     }
    return $headers;
}, 999 );

For example, as a means to prevent clickjacking, the X-Frame-Options: SAMEORIGIN header ensures that a frame can be displayed only on the same origin as the page it is embedded on.

add_action( 'wp_headers', function( $headers ) {
    if ( ! isset( $headers['X-Frame-Options'] ) {
        $headers['X-Frame-Options'] = 'SAMEORIGIN';
     }
    return $headers;
}, 999 );

Send headers

The send_headers hook can also be used to send headers. This hook fires once the requested HTTP headers for caching, content type, et al, have already been sent, which means there isn’t an opportunity to check and avoid sending duplicate headers. It can be useful when there is already a function that exists with a header() call.

For example, the following line is an alternative implementation of the above X-Frame-Options header, as the send_frame_options_header function already exists in WordPress:

add_action( 'send_headers', 'send_frame_options_header', 10, 0 );