Automatically enforces essential HTTP security headers to protect your site from XSS, clickjacking, and protocol downgrade attacks.

Alex Lion (阿力獅)

Andrea Ferro

Augusto Bombana

Rimas

Headers Security Advanced & HSTS WP

Best all-in-one WordPress security plugin, uses HTTP & HSTS response headers to avoid vulnerabilities: XSS, injection, clickjacking. Force HTTP/HTTPS.

Dimitar Ivanov

HTTP Headers

HTTP Headers adds CORS & security HTTP headers to your website.

Nick C

GNU Terry Pratchett

Add an X-Clacks-Overhead header with “GNU Terry Pratchett” to all non-admin pages.

Mikel King

Simple Iframe Buster

Provides a method of setting the X-Frame-Options header to SAMEORIGIN. Also enqueues a javascript based iframe blocker.

Sentinel Headers Unlimited Extension

Louis

WP Secure HTTP Headers

License: GPLv2 or later WordPress plugin to add secure headers to your website.

Rob Scott

Eazy HTTP Headers

Provides settings to activate three HTTP header settings for X-Frame-Options, X-XSS Protection & X-Content-Type-Options.

bluetriangle

SeaSP Community Edition

SeaSP Community Edition is an automated Content Security Policy Manager. SeaSP allows you to create, configure, manage, and deploy a Content Security  …

Justin Kopepasah

Strict Security Headers

Easily enable modern security headers for your website with the Strict Security Headers plugin, with no configuration required.

WP Remove Authors Sitemap from Yoast SEO

License: GPLv2 or later WordPress plugin to remove authors from the Yoast SEO Sitemap

Jay Suthar

BoundaryGuard Headers enforces modern HTTP security headers to harden your WordPress site against XSS, clickjacking, mixed content, and cross-origin attacks.
Key Features:
<ul>
<li>Essential Protection: Adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy to reduce attack surface and prevent clickjacking.</li>
<li>HSTS (Strict Transport Security): Forces HTTPS connections to help prevent protocol downgrade and man-in-the-middle attacks.</li>
<li>Advanced Isolation (COOP/COEP): Enables Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy to improve cross-origin isolation and mitigate certain side-channel attacks.</li>
<li>Content Security Policy (CSP): One of the strongest defenses against XSS. Includes a dashboard-based CSP builder with preset options to whitelist trusted sources for scripts, styles, images, and more.</li>
<li>CSP Report-Only Mode: Test your policy safely without blocking content.</li>
<li>Server Header Hardening: Removes or limits exposure of headers such as <code>X-Powered-By</code> and <code>Server</code>.</li>
<li>Lightweight and Fast: Uses PHP headers for broad server compatibility and minimal performance impact.</li>
<li>No <code>.htaccess</code> Editing Required: Works without modifying server configuration files.</li>
</ul>
Designed for developers and site owners who want stronger security without unnecessary complexity.
<h3>External Services</h3>
This plugin provides a Content Security Policy (CSP) builder. To assist users, it includes “Preset Buttons” that allow users to quickly add domain names to their own CSP whitelist.
This plugin DOES NOT connect to, load data from, or send data to these services automatically. The following third-party domains are referenced as presets within the admin dashboard for whitelisting purposes: 
* Google Analytics (www.google-analytics.com) – Used for tracking whitelisting. [Privacy: https://policies.google.com/privacy] 
* Google Tag Manager (www.googletagmanager.com) – Used for tag management. [Privacy: https://policies.google.com/privacy] 
* Stripe (js.stripe.com, api.stripe.com) – Used for payment processing. [Privacy: https://stripe.com/privacy] 
* Facebook (www.facebook.com, connect.facebook.net) – Used for social embeds. [Privacy: https://www.facebook.com/policy.php] 
* YouTube (www.youtube.com, i.ytimg.com) – Used for video embeds. [Privacy: https://policies.google.com/privacy] 
* Vimeo (player.vimeo.com) – Used for video embeds. [Privacy: https://vimeo.com/privacy] 
* Gravatar (secure.gravatar.com) – Used for user avatars. [Privacy: https://automattic.com/privacy/]

Alternatives to BoundaryGuard Headers

Top alternatives