manifest / security / site-security-headers

Site Security Headers

Check your WordPress website for headers that are common for security purposes.

by Robert Miller · github.com/runthis/site-security-headers

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/runthis/site-security-headers/archive/refs/heads/master.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/runthis/site-security-headers ↗

Wordpress Site Security Headers

This is a WordPress plugin that checks your WordPress website for common headers associated with security. This plugin is opinionated and these things will not directly apply to every situation, so it is best to analyze individual applications to determine your own best path forward.

Header name	Expects
strict-transport-security	`max-age` >= 31536000
referrer-policy	`no-referrer` `no-referrer-when-downgrade` `origin` `origin-when-cross-origin` `same-origin` `strict-origin` `strict-origin-when-cross-origin`
permissions-policy	Just expects this to exist in some way
content-security-policy	Minimum of: `default-src 'none'`
x-frame-options	`deny` `sameorigin` `allow-from`
x-content-type-options	`nosniff`
x-xss-protection	`0` `1` (informs you that it is deprecated and recommends CSP)