Blucube

If your site has an SSL certificate you might find that you can access the site via both SSL (https) and non-SSL (http) URLs. This is a bad idea for security, and for SEO, as it can look like duplicate content on different URLs.
The answer to this is to redirect requests to non-SSL (http) URLs over to their SSL (https) equivalents using something called a 301 redirect. This tells the client (and search engines) that the resource they are looking for should always be accessed over SSL. This plugin offers two methods to achieve this:
<ul>
<li>By intercepting WordPress pages at header time, and if they are not already being requested over HTTPS sending a 301 redirect header, or</li>
<li>By adding mod_rewrite rules in the .htaccess file to redirect all requests to their HTTPS equivalents using 301 redirects.</li>
</ul>
Optionally, this plugin can also set <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security" rel="nofollow ugc">HSTS</a> headers for you, and make sure that all requests use the same hostname (i.e. fixing the issue where many sites can be accessed using both www. and non-www. URLs).

Simple SSL Redirects

Lightweight plugin to ensure access via SSL/HTTPS. Uses 301 (permanent) redirects for SEO benefits. Optionally sets HSTS and forces canonical domain.

Vishwa

vishvega

HeaderShield adds a conservative set of security headers that improve browser protection without breaking most sites. It also provides optional strict cross-origin protections for sites that are ready for them.
Default headers include:
<ul>
<li>X-Frame-Options</li>
<li>X-Content-Type-Options</li>
<li>X-XSS-Protection (legacy)</li>
<li>Referrer-Policy</li>
<li>Permissions-Policy</li>
<li>Content-Security-Policy (upgrade-insecure-requests)</li>
<li>Strict-Transport-Security (HTTPS only)</li>
</ul>
Strict Mode can additionally enable COEP, COOP, and CORP for stronger isolation, but may break third‑party scripts or embeds. Use with care and test on staging first.
<h4>Source code for third-party assets</h4>
The admin UI uses SlimSelect for the multi-select dropdown. Human-readable source is included in the plugin:
<ul>
<li>JavaScript: <code>assets/js/slimselect.js</code> (minified build: <code>assets/js/slimselect.min.js</code>)</li>
<li>CSS: <code>assets/css/slimselect.css</code> (minified build: <code>assets/css/slimselect.min.css</code>)</li>
</ul>
Upstream project: https://github.com/brianvoe/slim-select (MIT). This plugin does not use a custom build process; the included files are from the published release.

HeaderShield

Add safe, modern HTTP security headers with optional strict cross-origin protections and a simple admin UI.

Simple SSL Redirects vs HeaderShield