HTTP Security Header

You can enable the following security headers:

• HTTP Strict Transport Security (HSTS)
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Content-Security-Policy (CSP)
• X-XSS-Protection
• Permissions-Policy (Merged with Feature-Policy)
• X-Permitted-Cross-Domain-Policies
• Expect-CT
• Cross-Origin-Opener-Policy (COOP)
• Cross-Origin-Resource-Policy (CORP)

Yes, the plugin is fully compatible with WP-Rocket. It ensures that security headers are preserved even when WP-Rocket caching is enabled by directly modifying the .htaccess file.

Yes, this plugin works with all WordPress themes, as it modifies the HTTP headers sent by your web server without affecting the content or styling of your site.

Yes, the plugin modifies the .htaccess file to set headers at the server level, ensuring maximum security. This method provides robust header implementation while maintaining compatibility with caching plugins.

Most modern browsers, including Chrome, Edge, Firefox, and Safari, support these security headers. However, some older browsers may not fully support certain headers like Content-Security-Policy (CSP) or Permissions-Policy. To ensure maximum security, we recommend using a modern browser and checking header compatibility at Can I Use.

No coding knowledge is required. The plugin provides a simple admin interface where you can enable or disable headers with just a click.

You can use tools like InspiredMonks.com or browser developer tools to inspect the HTTP headers and confirm that your settings are applied correctly.

If a specific header is interfering with your website or a third-party service, you can disable it from the Settings > Security Headers page. Each header is independently configurable, so you can toggle only the ones you need.

Adding security headers generally has a minimal impact on performance. The headers are small in size and add a negligible amount of data to each request. This plugin only sets headers at the server level without altering front-end content or site functionality.

Yes, the Security Header plugin is compatible with WordPress multisite installations. However, you’ll need to configure security headers individually for each site in the network.

While security headers provide a robust layer of protection against specific attack vectors (e.g., XSS, clickjacking), they are not a complete security solution. Using this plugin in combination with other security practices, such as regular updates, strong passwords, and security plugins, is recommended.

To uninstall, simply deactivate and delete the plugin from the Plugins menu. All headers set by the plugin will be removed, restoring your website to its previous state.