StampyCode

This plugin addresses the need for a simple way to add HTTP headers to outbound HTTP responses in your site.
These headers can include custom ones specific to your application, or can be security related. Some you may wish to specify to protect your site may include:
<ul>
<li>Public-Key-Pins</li>
<li>Strict-Transport-Security</li>
<li>X-Frame-Options</li>
<li>X-XSS-Protection</li>
<li>X-Content-Type-Options</li>
<li>Content-Security-Policy</li>
<li>Content-Security-Policy-Report-Only</li>
</ul>
<h3>Related Links</h3>
<ul>
<li><a href="http://www.troyhunt.com/2015/09/introducing-you-to-browser-security.html" rel="nofollow ugc">Troy Hunt – Introducing you to browser security headers on Pluralsight</a></li>
<li><a href="https://app.pluralsight.com/library/courses/browser-security-headers" rel="nofollow ugc">PluralSight.com – Introduction to Browser Security Headers</a></li>
<li><a href="https://www.owasp.org/index.php/List_of_useful_HTTP_headers" rel="nofollow ugc">OWASP – List of useful HTTP headers</a></li>
<li><a href="https://scotthelme.co.uk/hardening-your-http-response-headers/" rel="nofollow ugc">Scott Helme – Hardening your HTTP response headers</a></li>
</ul>

Headit

Headit is a simple plugin to allow you to add custom HTTP response headers to your site.

Ayesh Karunaratne

This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site.
SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to support all PHP versions WordPress supports.
There is no administrative UI provided: Activate this plugin, and you are all set!
You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from <code>Lax</code> (default), <code>Strict</code>, or <code>None</code>. You can read about <a href="https://php.watch/articles/PHP-Samesite-cookies" rel="nofollow ugc">SameSite cookies here</a>.
To configure the <code>SameSite</code> flag value, edit your WordPress configuration file (<code>wp-config.php</code>), and add the following lines right above <code>/** Sets up WordPress vars and included files. */</code>.
<pre><code>define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.
</code></pre>
Note that only the authentication cookies are affected. Regular cookies that your installed plugins set will not be affected, nor provide any meaningful value with <code>SameSite</code> flags.

SameSite Cookies

Wasted two days on this

I don't know why the Author created this plugin, It does not work, please remove it from the plugin library

The plugin doesn't work

CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies.

Headit vs SameSite Cookies