Simple plugin to enable security headers in Wordpress, drop into the plugins directory and then enable via your WP dashboard

add-security-headers.php

<?php
/*
Plugin Name: Add Security Headers
Description: adds security headers to wordpress
*/

function add_security_headers() {
    if ( $_SERVER['HTTP_X_FORWARDED_SSL'] == 'on' ) {
        header('Strict-Transport-Security: max-age=31536000');
        header('X-XSS-Protection: 1; mode=block');
        header('X-Content-Type-Options: nosniff');
        header('X-Frame-Options: DENY');
    }
}
add_action( 'send_headers', 'add_security_headers' );