kevin

This plugin enables WordPress to send HSTS header to browser
IMPORTANT NOTE: This plugin won’t work if you use any WordPress caching plugin. If this is the case, then update your .htaccess file to specify HSTS header.
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking.
It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only secure HTTPS connections, and never via the insecure HTTP protocol

Simple HSTS Preload

This plugin enables HSTS header on WordPress

Vishwa

vishvega

HeaderShield adds a conservative set of security headers that improve browser protection without breaking most sites. It also provides optional strict cross-origin protections for sites that are ready for them.
Default headers include:
<ul>
<li>X-Frame-Options</li>
<li>X-Content-Type-Options</li>
<li>X-XSS-Protection (legacy)</li>
<li>Referrer-Policy</li>
<li>Permissions-Policy</li>
<li>Content-Security-Policy (upgrade-insecure-requests)</li>
<li>Strict-Transport-Security (HTTPS only)</li>
</ul>
Strict Mode can additionally enable COEP, COOP, and CORP for stronger isolation, but may break third‑party scripts or embeds. Use with care and test on staging first.
<h4>Source code for third-party assets</h4>
The admin UI uses SlimSelect for the multi-select dropdown. Human-readable source is included in the plugin:
<ul>
<li>JavaScript: <code>assets/js/slimselect.js</code> (minified build: <code>assets/js/slimselect.min.js</code>)</li>
<li>CSS: <code>assets/css/slimselect.css</code> (minified build: <code>assets/css/slimselect.min.css</code>)</li>
</ul>
Upstream project: https://github.com/brianvoe/slim-select (MIT). This plugin does not use a custom build process; the included files are from the published release.

HeaderShield

Add safe, modern HTTP security headers with optional strict cross-origin protections and a simple admin UI.

Simple HSTS Preload vs HeaderShield