Blog

WordPress 6.7: New Security Features You Should Know About

WordPress 6.7 brings important security updates. Here is what Norwegian online store owners need to know and do.

WordPressSecurityWooCommerce

September 15, 2026 · Stradenova

WordPress 6.7 was released in August 2026 with several significant security changes. For Norwegian online stores running WooCommerce, some of these are especially important. Here is a review of what is new and what you should do.

The Key Security Changes

Content Security Policy (CSP) Support

WordPress 6.7 introduces built-in support for Content Security Policy headers. This means you can now configure CSP directly from WordPress without editing .htaccess or using third-party plugins.

For online stores, this is important because CSP protects against:

Cross-site scripting (XSS): Prevents malicious code from running in customers’ browsers
Data injection: Blocks unauthorized loading of external resources
Form exploitation: Protects checkout forms against manipulation

Improved Authentication

Two-factor authentication (2FA) is now built into WordPress core, without the need for plugins like Wordfence or Two Factor Authentication. This also applies to WooCommerce customer accounts.

The recommendation is clear: Enable 2FA for all administrator accounts immediately. For customer accounts, you can offer it as optional.

Automatic Vulnerability Reporting

WordPress 6.7 now automatically checks installed plugins and themes against the official vulnerability database and alerts you in the dashboard. Previously, you needed services like WPScan or Patchstack for this.

Updated REST API Security

The REST API has received stricter access control by default. Unauthenticated requests to sensitive endpoints (such as user data and order details) are now automatically blocked.

What Should You Do?

1. Update to WordPress 6.7

This should obviously be done as soon as possible, but test first in a staging environment. Check specifically:

That the checkout flow works correctly
That payment gateway plugins are compatible
That any customizations in functions.php do not conflict

2. Configure CSP

Start with reporting mode to identify any violations before enforcing. A good starting CSP for WooCommerce:

default-src 'self';
script-src 'self' 'unsafe-inline' *.klarna.com *.vipps.no *.google-analytics.com;
style-src 'self' 'unsafe-inline' fonts.googleapis.com;
img-src 'self' data: *.cloudinary.com *.cdn.shopify.com;

Customize the list based on which third-party services you use.

3. Enable 2FA

Go to Users > Security in the WordPress dashboard and enable 2FA for all administrators. Support both authenticator apps (TOTP) and security keys (WebAuthn).

4. Review Plugin Alerts

Check the new security panel in the dashboard. Do you have plugins with known vulnerabilities? Update or replace them.

5. Update WooCommerce

WooCommerce 9.3 is adapted for WordPress 6.7 and includes its own security fixes. Run wp plugin update woocommerce or update via the dashboard.

Special Considerations for Norwegian Online Stores

Norwegian online stores have some extra considerations:

Klarna Checkout: Ensure CSP rules include Klarna’s domains (*.klarna.com, *.klarnacdn.net)
Vipps: Add *.vipps.no and *.vippsmobilepay.com to script-src
Bring/Posten: Shipping modules may require access to *.bring.no and *.mybring.com
Nets/Dibs: Add *.dibspayment.eu to script-src

When Should You Update?

Now. WordPress 6.7 fixes 14 known vulnerabilities from 6.6.x. Every day you wait is a day your store is exposed to known attack methods. Test in staging, verify everything works, and roll out to production.