Studio Be4

<p>Security Headers & Caching is a comprehensive WordPress plugin that helps protect your website by implementing essential HTTP security headers and optimizing performance through intelligent caching mechanisms. Compatible with all hosting providers including Aruba, SiteGround, Bluehost, and more.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Easy Configuration</strong> – Simple admin interface to enable/disable security headers</li>
<li><strong>Multiple Security Headers</strong> – Comprehensive security header support</li>
<li><strong>Smart Caching</strong> – Configurable cache duration for better performance</li>
<li><strong>Universal Compatibility</strong> – Works with all hosting providers</li>
<li><strong>No Conflicts</strong> – Compatible with popular security and caching plugins</li>
<li><strong>Translation Ready</strong> – Full internationalization support</li>
</ul>
<h4>Security Headers Included</h4>
<ul>
<li><strong>X-Powered-By</strong> – Removes server technology information to prevent targeted attacks</li>
<li><strong>Content-Security-Policy (CSP)</strong> – Controls which resources can be loaded to prevent XSS attacks</li>
<li><strong>Strict-Transport-Security (HSTS)</strong> – Forces HTTPS connections for enhanced security</li>
<li><strong>X-XSS-Protection</strong> – Enables XSS filtering in older browsers</li>
<li><strong>X-Frame-Options</strong> – Prevents clickjacking attacks by controlling iframe embedding</li>
<li><strong>X-Content-Type-Options</strong> – Prevents MIME type sniffing</li>
<li><strong>Referrer-Policy</strong> – Controls how much referrer information is shared</li>
<li><strong>Permissions-Policy</strong> – Controls browser features and APIs</li>
</ul>
<h4>Caching Features</h4>
<ul>
<li>Configurable cache duration (seconds)</li>
<li>Automatic cache headers management</li>
<li>Compatible with CDN services</li>
<li>No conflict with existing cache plugins</li>
</ul>
<h4>Why Security Headers Matter</h4>
<p>Security headers are HTTP response headers that tell your browser how to behave when handling your website’s content. They help protect against:</p>
<ul>
<li>Cross-Site Scripting (XSS) attacks</li>
<li>Clickjacking attempts</li>
<li>Code injection attacks</li>
<li>MIME type sniffing</li>
<li>Protocol downgrade attacks</li>
<li>And much more…</li>
</ul>
<h4>Developer Friendly</h4>
<p>The plugin provides filters for developers to customize headers:</p>
<ul>
<li><code>shc_security_headers</code> – Filter to modify security headers array</li>
</ul>
<h4>Test Your Security</h4>
<p>After installing and configuring the plugin, test your site’s security at:<br />
* <a href="https://securityheaders.com/" rel="nofollow ugc">Security Headers</a><br />
* <a href="https://observatory.mozilla.org/" rel="nofollow ugc">Mozilla Observatory</a></p>
<h4>Privacy</h4>
<p>This plugin does not collect, store, or transmit any user data. It only modifies HTTP response headers sent by your server.</p>
<h3>Developer Documentation</h3>
<h4>Filters</h4>
<p><strong>shc_security_headers</strong></p>
<p>Modify the security headers before they are sent.</p>
<pre><code>add_filter( 'shc_security_headers', function( $headers ) {
    // Add custom header
    $headers['X-Custom-Header'] = 'custom-value';

    // Modify existing header
    $headers['X-Frame-Options'] = 'DENY';

    return $headers;
} );
</code></pre>
<h4>Constants</h4>
<ul>
<li><code>SHC_VERSION</code> – Plugin version number</li>
<li><code>SHC_PLUGIN_DIR</code> – Plugin directory path</li>
<li><code>SHC_PLUGIN_URL</code> – Plugin directory URL</li>
<li><code>SHC_PLUGIN_BASENAME</code> – Plugin basename</li>
</ul>
<h3>Support</h3>
<p>For support, feature requests, or bug reports, please visit:<br />
* <a href="https://www.studiobe4.it" rel="nofollow ugc">Plugin Website</a></p>
<h3>Credits</h3>
<p>Developed by <a href="https://www.studiobe4.it" rel="nofollow ugc">Studio Be4</a> – Web Design & Development Agency</p>
<h3>License</h3>
<p>This plugin is licensed under the GPLv2 or later.</p>


Security Headers & Caching

Enhance your WordPress site security with HTTP security headers and improve performance with smart caching. Works with all hosting providers.

Jay Suthar

<p>BoundaryGuard Headers enforces modern HTTP security headers to harden your WordPress site against XSS, clickjacking, mixed content, and cross-origin attacks.</p>
<p><strong>Key Features:</strong></p>
<ul>
<li><strong>Essential Protection:</strong> Adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy to reduce attack surface and prevent clickjacking.</li>
<li><strong>HSTS (Strict Transport Security):</strong> Forces HTTPS connections to help prevent protocol downgrade and man-in-the-middle attacks.</li>
<li><strong>Advanced Isolation (COOP/COEP):</strong> Enables Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy to improve cross-origin isolation and mitigate certain side-channel attacks.</li>
<li><strong>Content Security Policy (CSP):</strong> One of the strongest defenses against XSS. Includes a dashboard-based CSP builder with preset options to whitelist trusted sources for scripts, styles, images, and more.</li>
<li><strong>CSP Report-Only Mode:</strong> Test your policy safely without blocking content.</li>
<li><strong>Server Header Hardening:</strong> Removes or limits exposure of headers such as <code>X-Powered-By</code> and <code>Server</code>.</li>
<li><strong>Lightweight and Fast:</strong> Uses PHP headers for broad server compatibility and minimal performance impact.</li>
<li><strong>No <code>.htaccess</code> Editing Required:</strong> Works without modifying server configuration files.</li>
</ul>
<p>Designed for developers and site owners who want stronger security without unnecessary complexity.</p>
<h3>External Services</h3>
<p>This plugin provides a Content Security Policy (CSP) builder. To assist users, it includes “Preset Buttons” that allow users to quickly add domain names to their own CSP whitelist.</p>
<p><strong>This plugin DOES NOT connect to, load data from, or send data to these services automatically.</strong> The following third-party domains are referenced as presets within the admin dashboard for whitelisting purposes:<br />
* Google Analytics (www.google-analytics.com) – Used for tracking whitelisting. [Privacy: https://policies.google.com/privacy]<br />
* Google Tag Manager (www.googletagmanager.com) – Used for tag management. [Privacy: https://policies.google.com/privacy]<br />
* Stripe (js.stripe.com, api.stripe.com) – Used for payment processing. [Privacy: https://stripe.com/privacy]<br />
* Facebook (www.facebook.com, connect.facebook.net) – Used for social embeds. [Privacy: https://www.facebook.com/policy.php]<br />
* YouTube (www.youtube.com, i.ytimg.com) – Used for video embeds. [Privacy: https://policies.google.com/privacy]<br />
* Vimeo (player.vimeo.com) – Used for video embeds. [Privacy: https://vimeo.com/privacy]<br />
* Gravatar (secure.gravatar.com) – Used for user avatars. [Privacy: https://automattic.com/privacy/]</p>


BoundaryGuard Headers

Automatically enforces essential HTTP security headers to protect your site from XSS, clickjacking, and protocol downgrade attacks.

Security Headers & Caching vs BoundaryGuard Headers