Header Fortress

Header Fortress is a WordPress plugin for managing modern security headers from the admin area, with CSP nonce support, presets, live scanning, and built-in reporting tools.

What it does

Header Fortress can manage:

• Content-Security-Policy
• Strict-Transport-Security
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• Cross-Origin-Opener-Policy
• Cross-Origin-Embedder-Policy
• Cross-Origin-Resource-Policy
• Clear-Site-Data
• Report-To
• NEL

It also includes:

• dynamic CSP nonce injection for WordPress-generated scripts
• security presets for different hardening profiles
• a scanner that compares plugin-managed headers with the live response
• a reporting screen for recent stored browser reports
• import, export, and reset tools

Important behavior

• The plugin works at the WordPress layer.
• If Cloudflare, LiteSpeed, Nginx, Apache, a reverse proxy, or another plugin manages the same headers, the final response can differ from the plugin configuration.
• HSTS is only sent on HTTPS responses.
• Reporting features such as Report-To and NEL expose a public browser-facing endpoint and should be reviewed before production rollout.

Installation

1. Copy the header-fortress directory into wp-content/plugins/.
2. Activate the plugin in WordPress.
3. Open Settings > Header Fortress.
4. Start with a preset or configure each header directly.
5. Use the Scanner tab to validate the live response.

Development notes

• Main bootstrap: header-fortress.php
• Core settings: includes/class-settings.php
• Admin UI: includes/class-admin-page.php
• Runtime headers: includes/class-header-manager.php
• Reports endpoint: includes/class-report-manager.php
• Scanner: includes/class-scanner.php

Data storage

The plugin does not modify server config files such as .htaccess, wp-config.php, Apache vhosts, or Nginx configs.

It stores data in WordPress options and transients, including:

• plugin settings
• cached scanner results
• recent stored reports
• short-lived deduplication and rate-limit transients for the reporting endpoint

License

GPL-2.0-or-later