John Godley

HTML Purified replaces the default WordPress comments filters with HTML Purifier, a super HTML filtering 
library.
<blockquote>
HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will 
 not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet 
 permissive whitelist, it will also make sure your documents are standards compliant, something 
 only achievable with a comprehensive knowledge of W3C’s specifications.
</blockquote>
An additional feature of HTML Purifier is that it will produce valid well-formed XHTML code, something 
which KSES does not do.
Features:
<ul>
<li>Configurable KSES or HTML Purifier</li>
<li>Configurable list of HTML elements and attributes for both KSES and HTML purifier</li>
<li>Additionally process comments with HTML Tidy</li>
<li>URL blacklist</li>
<li>Fully localized (and awaiting translations)</li>
<li>Automatically escape PHP or anything inside backticks</li>
</ul>
HTML Purifier is available in:
<ul>
<li>English</li>
<li>Spanish, thanks to José Cuesta</li>
<li>Belorussian, thanks to Marcis Gasuns</li>
<li>Russian, thanks to Ilyuha</li>
<li>Uzbekistan, thanks to Alexandra Bolshova</li>
<li>Dutch, thanks to Pieter</li>
<li>German, thanks to Andreas Beraz</li>
<li>Polish, thanks to Kasia Ciszewski & Dawid Śpiechowicz</li>
<li>Romanian, thanks to Alina @ InboxTranslations.com</li>
<li>Lithuanian, thanks to Nata Strazda</li>
<li>Ukranian, thanks to Iflexion Design</li>
</ul>
<h3>Documentation</h3>
Full documentation can be found on the <a href="http://urbangiraffe.com/plugins/html-purified/" rel="nofollow ugc">HTML Purified</a> page.

HTML Purified

HTML Purified replaces the default comments filters with the more secure HTML Purifier.

Jay Suthar

BoundaryGuard Headers enforces modern HTTP security headers to harden your WordPress site against XSS, clickjacking, mixed content, and cross-origin attacks.
Key Features:
<ul>
<li>Essential Protection: Adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy to reduce attack surface and prevent clickjacking.</li>
<li>HSTS (Strict Transport Security): Forces HTTPS connections to help prevent protocol downgrade and man-in-the-middle attacks.</li>
<li>Advanced Isolation (COOP/COEP): Enables Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy to improve cross-origin isolation and mitigate certain side-channel attacks.</li>
<li>Content Security Policy (CSP): One of the strongest defenses against XSS. Includes a dashboard-based CSP builder with preset options to whitelist trusted sources for scripts, styles, images, and more.</li>
<li>CSP Report-Only Mode: Test your policy safely without blocking content.</li>
<li>Server Header Hardening: Removes or limits exposure of headers such as <code>X-Powered-By</code> and <code>Server</code>.</li>
<li>Lightweight and Fast: Uses PHP headers for broad server compatibility and minimal performance impact.</li>
<li>No <code>.htaccess</code> Editing Required: Works without modifying server configuration files.</li>
</ul>
Designed for developers and site owners who want stronger security without unnecessary complexity.
<h3>External Services</h3>
This plugin provides a Content Security Policy (CSP) builder. To assist users, it includes “Preset Buttons” that allow users to quickly add domain names to their own CSP whitelist.
This plugin DOES NOT connect to, load data from, or send data to these services automatically. The following third-party domains are referenced as presets within the admin dashboard for whitelisting purposes: 
* Google Analytics (www.google-analytics.com) – Used for tracking whitelisting. [Privacy: https://policies.google.com/privacy] 
* Google Tag Manager (www.googletagmanager.com) – Used for tag management. [Privacy: https://policies.google.com/privacy] 
* Stripe (js.stripe.com, api.stripe.com) – Used for payment processing. [Privacy: https://stripe.com/privacy] 
* Facebook (www.facebook.com, connect.facebook.net) – Used for social embeds. [Privacy: https://www.facebook.com/policy.php] 
* YouTube (www.youtube.com, i.ytimg.com) – Used for video embeds. [Privacy: https://policies.google.com/privacy] 
* Vimeo (player.vimeo.com) – Used for video embeds. [Privacy: https://vimeo.com/privacy] 
* Gravatar (secure.gravatar.com) – Used for user avatars. [Privacy: https://automattic.com/privacy/]

BoundaryGuard Headers

Automatically enforces essential HTTP security headers to protect your site from XSS, clickjacking, and protocol downgrade attacks.

HTML Purified vs BoundaryGuard Headers