HTTP headers to improve web site security


This plug-in helps setting up the various header instructions included in the HTTP protocol allowing for simple improvement of your website security.

This plug-in provides enabling of the following measures:

  • HSTS (Strict-Transport-Security)
  • CSP (Content-Security-Policy)
  • Clickjacking mitigation (X-Frame-Options in main site)
  • XSS protection (X-XSS-Protection)
  • Disabling content sniffing (X-Content-Type-Options)
  • Referrer policy
  • Expect-CT
  • PHP-Versionsinformationen aus dem HTTP-Header entfernen
  • WordPress-Versionsinformationen aus dem HTTP-Header entfernen ist eine nützliche Ressource für die Bewertung der Sicherheit Deiner Website.

As usual, make sure to understand the meaning of these options and to run full tests on your web site as some options may result in some features stop working.


  • Allgemeine Einstellungen Bildschirm.
  • Content-Security-Policy directives settings screen.
  • .htaccess contents screen.


  1. Lade die Plugin-Dateien in das Verzeichnis /wp-content/plugins/http-security hoch oder installiere das Plugin direkt über den WordPress Plugin-Bildschirm.
  2. Aktiviere das Plugin über den „Plugins“ -Bildschirm in WordPress.
  3. Verwende den Bildschirm Einstellungen -> HTTP Security, um das Plugin zu konfigurieren.


Wie kann ich die Plug-In-Läufe effektiv testen?

Überprüfe die HTTP-Header Deiner Website.


Works great with one CSP issue

I've used this to implement http security headers on my WordPress site. Very easy to use and get good scores on evaluation sites. Content Security Policy seems to be an emerging technique to improve security. Its easy to implement using this plugin. Only one problem I've noticed: When I input data in the box for base-uri: and then check with Google CSP Evaluator it shoes all of the CSP values except for base-uri where it shows "base-uri;" regards of what's entered in the plugin. Base-uri doesn't fall back to the default-src directive so this shows up as an issue. Still deserves 5 stars for its ease of use.

Good Job

I really like this plugin. I tried others for CSP and I chose this over the others for its ease of use. CSP is complicated enough. By using this plugin it is easier to implement a content security policy and security headers on WordPress. I highly recommend this plugin. Thanks for taking the time to make this plugin.


Perfect plugin for the job it needs to do. The developer is great as well!

Perfectly pitched

Really useful plugin for helping with these headers. In addition to also check out your site using for additional feedback. Many thanks.

Facilitating Content Security Policy, X-XSS-Protection, HSTS etc.

I had started writing code in my header and was trying various values for the many directives, after breaking the pages. I decided to look at plugins. The issue was how to speed up the process. This plugin seemed to offer what I needed. In conjunction with the site, I soon attained an 'A' rating. Thank you Conrad for a very useful plugin. This is a great start and I hope you will keep up with the new levels of CSP.
Lies alle 7 Rezensionen

Mitwirkende & Entwickler

„HTTP headers to improve web site security“ ist Open-Source-Software. Folgende Menschen haben an diesem Plugin mitgewirkt:


„HTTP headers to improve web site security“ wurde in 6 Sprachen übersetzt. Danke an die Übersetzerinnen und Übersetzer für ihre Mitwirkung.

Übersetze „HTTP headers to improve web site security“ in deine Sprache.

Interessiert an der Entwicklung?

Durchstöbere den Code, sieh dir das SVN Repository an oder abonniere das Entwicklungsprotokoll per RSS.



  • Added support for Feature-Policy


  • Mit WordPress 5.0 getestet


  • Added .htaccess instructions


  • Mit WordPress 4.9 getestet


  • Added support for Expect-CT
  • Cleaned up the interface


  • Switched to languages packs


  • Added support for Referrer-Policy directive
  • Added uninstall database cleanup


  • Added support for all Content-Security-Policy directives
  • Reworked the user interface


  • Added setting the mode for x-frame-options


  • Removed HSTS header when connected in HTTP


  • Fixed HSTS syntax warning


  • Added support for Content-Security-Policy


  • Added critical issues notifications


  • Added max-age option to HSTS setting


  • Added option to remove WordPress version information from the header


  • Added option to remove PHP version information from the HTTP header


  • Included link to submit site preload to browsers
  • Reduced HSTS max-age to one year


  • Added X-Frame-Options protection.
  • Added X-Content-Type-Options protection.
  • Added HSTS options.


  • Added XSS protection option.


  • Erste stabile Version, mit grundlegende HSTS-Unterstützung.