Guilherme Dumas Peres

CSP Violation Reporter adds a public WordPress REST endpoint for browser Content Security Policy violation reports and stores received violations in a local database table.
Reports can be reviewed from Tools > CSP Violations. The plugin supports the modern Reporting API payload format as well as the older <code>csp-report</code> JSON shape.
Endpoint:
<pre><code>/wp-json/csp-violation-reporter/v1/report
</code></pre>
The plugin does not create or modify Content Security Policy headers. Site owners should configure CSP headers in their web server, hosting dashboard, theme, or security tooling.
Example report endpoint configuration:
<pre><code>Content-Security-Policy: default-src 'self'; report-uri https://example.com/wp-json/csp-violation-reporter/v1/report
</code></pre>
For the modern Reporting API, use an HTTPS endpoint:
<pre><code>Reporting-Endpoints: csp-endpoint="https://example.com/wp-json/csp-violation-reporter/v1/report"

Content-Security-Policy: default-src 'self'; report-to csp-endpoint
</code></pre>
<h3>Privacy</h3>
This plugin stores CSP violation reports submitted by browsers. Stored fields can include the document URL, referrer URL, blocked URI, violated directive, source file, line and column numbers, a user agent string, a salted hash of the remote address, and the raw report payload.
The plugin does not store raw IP addresses and does not transmit report data to external services.

CSP Violation Reporter

Collect Content Security Policy violation reports through a WordPress REST endpoint and review them in the admin dashboard.

MOHIT GOYAL

HTTP Security Header helps protect your WordPress site by adding critical HTTP headers to each response — with no code required. These headers provide additional layers of protection against attacks such as cross-site scripting (XSS), clickjacking, content injection, and resource leaks.
This plugin offers a modern, responsive admin dashboard with validation, fallback safety, and full control over each header’s default or custom value.
<h3>🔎 Scan Your Website Security Headers</h3>
Before configuring headers, instantly check your website’s current security score using our online header scanner:
👉 <a href="https://inspiredmonks.com/http-security-header-scanner/" rel="nofollow ugc">Scan Your Website Security Headers</a>
✔ Enter your website URL 
✔ Get instant Security Grade (A+ to F) 
✔ See which headers are Present or Missing 
✔ Get clear, actionable recommendations 
✔ Easily fix them using this plugin
Used by thousands of websites to enhance security and protect user data.
Features Include: 
– Visual toggles for enabling/disabling headers 
– Option to use default or custom header values 
– Secure fallback if a header is misconfigured 
– Integrated header validation 
– Support for all major browser-supported headers 
– Nonce-based saving and admin notices 
– WP Multisite compatible 
– “Disable All” and “Reset to Important Headers” actions 
– Per-header input validation with real-time error fallback
Supported Headers: 
* Strict-Transport-Security (HSTS) 
* X-Frame-Options 
* X-Content-Type-Options 
* Referrer-Policy 
* Content-Security-Policy 
* Permissions-Policy 
* X-XSS-Protection 
* X-Permitted-Cross-Domain-Policies 
* Expect-CT 
* Cross-Origin-Opener-Policy (COOP) 
* Cross-Origin-Resource-Policy (CORP) 
* Cross-Origin-Embedder-Policy (COEP)
<h3>Features</h3>
<ul>
<li>Lightweight and performance-focused </li>
<li>No front-end impact </li>
<li>Choose default or custom header values </li>
<li>Secure validation and auto-fallbacks </li>
<li>Seamless plugin compatibility (including WP Rocket) </li>
<li>Fully translation-ready and i18n-compliant </li>
<li>Nonce-protected admin save actions </li>
<li>Optional reset-to-default support </li>
<li>Reset or disable all headers with one click</li>
</ul>

HTTP Security Header


I recently integrated the Security Header plugin into my WordPress site, and it has significantly improved my website's security posture. The user-friendly interface made it easy to enable essential HTTP security headers with just a few clicks. 


Essential for Enhancing Website Security

Add and manage essential HTTP security headers with ease. Protect your WordPress site from XSS, clickjacking, and other common vulnerabilities.

CSP Violation Reporter vs HTTP Security Header