WP Manifestindependent plugin directory
manifest / security / header-security-fix-wordpress-plugin

Security Headers Fixer

Adds security headers (HSTS, CSP, Referrer-Policy, X-Frame-Options) and hardens target=_blank links.

by Shees · github.com/shees-zahid/header-security-fix-wordpress-plugin

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/shees-zahid/header-security-fix-wordpress-plugin/archive/refs/heads/main.zip
Readme github.com/shees-zahid/header-security-fix-wordpress-plugin ↗

🛡️ Header Security Fix — WordPress Plugin

One-click hardening for WordPress: HSTS · CSP · Referrer-Policy · X-Frame-Options · X-Content-Type-Options.
Ship secure HTTP headers without touching nginx, Apache, or your host's config.

PHP WordPress Security Status

❓ Why this exists

Most WordPress sites fail basic security header checks (Mozilla Observatory, securityheaders.com) because:

  1. Server-level headers (nginx / Apache / Cloudflare) require host access many devs don't have
  2. Existing security plugins bloat sites with 50+ features you don't need
  3. CSP is hard — most tutorials break your JS and you give up

This plugin does one thing well: adds a hardened set of HTTP security headers from a small PHP admin UI, safely, without breaking your site.

✨ What it adds

Header Purpose
Strict-Transport-Security (HSTS) Force HTTPS in browsers (only when enabled + on HTTPS)
Content-Security-Policy Restrict what scripts / styles / iframes can load
Referrer-Policy Control how much URL info leaks to third-party sites
X-Content-Type-Options: nosniff Stop MIME-type sniffing attacks
X-Frame-Options Stop clickjacking via iframes (only if CSP doesn't already include frame-ancestors)

✅ Verify

After activation, run one of:

curl -I https://your-site.example/

Or check with:

Expected boost: from F/D → A/A+ on most WordPress installs.

⚠️ Notes and limitations

  • Some headers (HSTS, CSP) are better at the web-server / CDN edge (nginx, Apache, Cloudflare) because they also cover static files and pre-WordPress responses. This plugin is useful when you can't touch those layers.
  • CSP starts in report-only mode so you can see what breaks before enforcing.
  • Not a substitute for: strong passwords, 2FA, keeping WP core / plugins updated, and disabling XML-RPC where you don't need it.

🛠️ Requirements

  • WordPress 5.8+
  • PHP 7.4+

📦 Install

  1. Clone into wp-content/plugins/ or upload as ZIP
  2. Activate in WP Admin
  3. Go to Settings → Header Security
  4. Toggle headers, save, verify with curl or securityheaders.com

🚦 Status

Stable. Actively maintained. Public reference implementation.

Part of the portfolio at github.com/Shees-Zahid by Shees Muhammad Zahid — Senior WordPress Developer & Team Lead.