Jay Suthar

BoundaryGuard Headers enforces modern HTTP security headers to harden your WordPress site against XSS, clickjacking, mixed content, and cross-origin attacks.
Key Features:
<ul>
<li>Essential Protection: Adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy to reduce attack surface and prevent clickjacking.</li>
<li>HSTS (Strict Transport Security): Forces HTTPS connections to help prevent protocol downgrade and man-in-the-middle attacks.</li>
<li>Advanced Isolation (COOP/COEP): Enables Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy to improve cross-origin isolation and mitigate certain side-channel attacks.</li>
<li>Content Security Policy (CSP): One of the strongest defenses against XSS. Includes a dashboard-based CSP builder with preset options to whitelist trusted sources for scripts, styles, images, and more.</li>
<li>CSP Report-Only Mode: Test your policy safely without blocking content.</li>
<li>Server Header Hardening: Removes or limits exposure of headers such as <code>X-Powered-By</code> and <code>Server</code>.</li>
<li>Lightweight and Fast: Uses PHP headers for broad server compatibility and minimal performance impact.</li>
<li>No <code>.htaccess</code> Editing Required: Works without modifying server configuration files.</li>
</ul>
Designed for developers and site owners who want stronger security without unnecessary complexity.
<h3>External Services</h3>
This plugin provides a Content Security Policy (CSP) builder. To assist users, it includes “Preset Buttons” that allow users to quickly add domain names to their own CSP whitelist.
This plugin DOES NOT connect to, load data from, or send data to these services automatically. The following third-party domains are referenced as presets within the admin dashboard for whitelisting purposes: 
* Google Analytics (www.google-analytics.com) – Used for tracking whitelisting. [Privacy: https://policies.google.com/privacy] 
* Google Tag Manager (www.googletagmanager.com) – Used for tag management. [Privacy: https://policies.google.com/privacy] 
* Stripe (js.stripe.com, api.stripe.com) – Used for payment processing. [Privacy: https://stripe.com/privacy] 
* Facebook (www.facebook.com, connect.facebook.net) – Used for social embeds. [Privacy: https://www.facebook.com/policy.php] 
* YouTube (www.youtube.com, i.ytimg.com) – Used for video embeds. [Privacy: https://policies.google.com/privacy] 
* Vimeo (player.vimeo.com) – Used for video embeds. [Privacy: https://vimeo.com/privacy] 
* Gravatar (secure.gravatar.com) – Used for user avatars. [Privacy: https://automattic.com/privacy/]

BoundaryGuard Headers

Automatically enforces essential HTTP security headers to protect your site from XSS, clickjacking, and protocol downgrade attacks.

Nick C

The GNU Terry Pratchett plugin transmits an “X-Clacks-Overhead” header reading, “GNU Terry Pratchett” so that Terry’s name is whispered forevermore in the Internet’s “overhead”.
In Pratchett’s “Going Postal”, workers who die in the line of duty have their names transmitted up and down the Discworld’s telegraph system as a tribute.
This plugin makes it easy for WordPress users to do the same for Terry Pratchett, without having to modify their server configuration.
<h4>The GNU Terry Pratchett headers</h4>
The plugin adds the GNU Terry Pratchett header in two ways:
<ol>
<li>As an HTTP header (if you don’t use a WordPress page caching plugin).</li>
<li>As a meta tag in your HTML with the http-equiv attribute.</li>
</ol>
<h4>Settings</h4>
The text sent in HTTP headers and meta tags is “GNU Terry Pratchett” by default.
Change this by visiting Settings → GNU Terry Pratchett in your WordPress admin area and editing the “X-Clacks-Overhead header” field.
This option lets you honor other people you would like to remember by making them a small part of your site’s content forever.
<h4>Checking the HTTP header is sent</h4>
There are several ways to check that the HTTP header is appearing for your site:
<ol>
<li>With your terminal (<code>curl -I example.com</code>)</li>
<li>With Chrome’s Network tab.</li>
<li>With the <a href="https://chrome.google.com/webstore/detail/clacks-overhead-gnu-terry/lnndfmobdoobjfcalkmfojmanbeoegab" rel="nofollow ugc">Clacks Overhead</a> Chrome plugin or the <a href="https://addons.mozilla.org/en-US/firefox/addon/gnu_terry_pratchett/" rel="nofollow ugc">GNU Terry Pratchett Firefox extension</a>.</li>
<li>Using the <a href="http://tools.seobook.com/server-header-checker/" rel="nofollow ugc">Server Header Checker</a>.</li>
</ol>
Note that the HTTP header is not sent if you use a page caching plugin. To send the HTTP header and continue to use a caching plugin, add the header at the server level. See http://www.gnuterrypratchett.com/ for options.
<h4>Checking the meta tag is added</h4>
You can check that the meta tag is visible by viewing your site’s HTML source and searching for “GNU Terry Pratchett”.
The <a href="https://chrome.google.com/webstore/detail/clacks-overhead-gnu-terry/lnndfmobdoobjfcalkmfojmanbeoegab" rel="nofollow ugc">Clacks Overhead plugin</a> for Chrome and the <a href="https://addons.mozilla.org/en-US/firefox/addon/gnu_terry_pratchett/" rel="nofollow ugc">GNU Terry Pratchett extension</a> for Firefox both light up when they detect the HTML meta tag or HTTP header.
<h4>Credits and contributions</h4>
Inspired by <a href="http://www.reddit.com/r/bestof/comments/2yyop7/rdiscworld_redditors_with_web_servers_start/" rel="nofollow ugc">this reddit post</a>, <a href="http://boingboing.net/2015/03/15/sending-terry-pratchett-home-w.html" rel="nofollow ugc">boingboing’s report</a>, and the <a href="http://www.gnuterrypratchett.com/" rel="nofollow ugc">GNU Terry Pratchett</a> website.
Contributions welcome at the <a href="https://github.com/nickcernis/gnu-terry-pratchett" rel="nofollow ugc">GitHub repo</a>.

GNU Terry Pratchett

Add an X-Clacks-Overhead header with “GNU Terry Pratchett” to all non-admin pages.

BoundaryGuard Headers vs GNU Terry Pratchett