Vishwa

vishvega

HeaderShield adds a conservative set of security headers that improve browser protection without breaking most sites. It also provides optional strict cross-origin protections for sites that are ready for them.
Default headers include:
<ul>
<li>X-Frame-Options</li>
<li>X-Content-Type-Options</li>
<li>X-XSS-Protection (legacy)</li>
<li>Referrer-Policy</li>
<li>Permissions-Policy</li>
<li>Content-Security-Policy (upgrade-insecure-requests)</li>
<li>Strict-Transport-Security (HTTPS only)</li>
</ul>
Strict Mode can additionally enable COEP, COOP, and CORP for stronger isolation, but may break third‑party scripts or embeds. Use with care and test on staging first.
<h4>Source code for third-party assets</h4>
The admin UI uses SlimSelect for the multi-select dropdown. Human-readable source is included in the plugin:
<ul>
<li>JavaScript: <code>assets/js/slimselect.js</code> (minified build: <code>assets/js/slimselect.min.js</code>)</li>
<li>CSS: <code>assets/css/slimselect.css</code> (minified build: <code>assets/css/slimselect.min.css</code>)</li>
</ul>
Upstream project: https://github.com/brianvoe/slim-select (MIT). This plugin does not use a custom build process; the included files are from the published release.

HeaderShield

Add safe, modern HTTP security headers with optional strict cross-origin protections and a simple admin UI.

WP Fix It - WordPress Experts

WP Fix It Easy Security Headers adds a simple page under Tools → Security Headers where you can toggle common HTTP security headers:
<ul>
<li>Strict-Transport-Security (HSTS)</li>
<li>Content-Security-Policy (CSP)</li>
<li>X-Frame-Options</li>
<li>X-Content-Type-Options</li>
<li>Referrer-Policy</li>
<li>Permissions-Policy</li>
</ul>
On activation, all headers are enabled by default and you’re redirected to the settings screen.
For convenience, the page and the Plugins screen include a “Check Headers” button that opens SecurityHeaders.com with your site’s URL prefilled (built dynamically from <code>home_url()</code>).
<h3>Notes on CSP</h3>
This plugin ships with a permissive default CSP intended to “work everywhere” out of the box (allows most external sources and inline code). For stronger protection, you should harden the directives for your specific site.
<h3>Key Features</h3>
<ul>
<li>One-click toggles for popular headers</li>
<li>Dynamic “Check Headers” scan link</li>
<li>Uses the WordPress Settings API (nonce + capability checks)</li>
<li>Output escaping and sanitization following PHPCS</li>
</ul>

Fix It Easy Security Headers

Configure core HTTP security headers for your WordPress site in a few clicks.

HeaderShield vs Fix It Easy Security Headers