Title: Security Headers Author: Joseph Mendez Published: 24. september, 2022 Last modified: 17. september, 2026 --- Søg plugins ![](https://ps.w.org/firstpage-sg-security-headers/assets/banner-772x250.png?rev =2789535) ![](https://ps.w.org/firstpage-sg-security-headers/assets/icon.svg?rev=2789535) # Security Headers Af [Joseph Mendez](https://profiles.wordpress.org/joshme21/) [Download](https://downloads.wordpress.org/plugin/firstpage-sg-security-headers.1.6.0.zip) * [Detaljer](https://da.wordpress.org/plugins/firstpage-sg-security-headers/#description) * [Vurderinger](https://da.wordpress.org/plugins/firstpage-sg-security-headers/#reviews) * [Installation](https://da.wordpress.org/plugins/firstpage-sg-security-headers/#installation) * [Udvikling](https://da.wordpress.org/plugins/firstpage-sg-security-headers/#developers) [Support](https://wordpress.org/support/plugin/firstpage-sg-security-headers/) ## Beskrivelse Security Headers helps site owners manage modern browser security headers from inside WordPress. Features include: * Admin settings page under Security Headers * HSTS controls with preload warning * Referrer-Policy and X-Frame-Options settings * Permissions-Policy custom value field * Minimal enforced CSP with upgrade-insecure-requests, separate from advanced source restrictions * Content-Security-Policy builder with Report-Only mode * Discover / Review / Enforce workflow with explicit source approvals and policy verification * Untrusted source suggestions from page HTML and browser CSP reports * Saved pre-workflow settings for recovery * Diagnostics screen showing configured headers * Test tool to fetch and inspect your live response headers * Import, export, and reset settings tools * Cleanup on uninstall ### Why security headers important? When auditing websites, security headers are frequently forgotten. Although some may argue that website security is unrelated to SEO, it does become so when a site is compromised and search traffic completely disappears. Everyone who publishes content online should pay special attention to security headers. Getting hacked is not good. You lose traffic, customers and it’s a pain to resolve all the issues. But good thing you’re smart and have searched for this plugin :). ## Installation 1. Upload the plugin folder to `/wp-content/plugins/` 2. Activate the plugin in WordPress 3. Go to Security Headers in the admin menu 4. Save your preferred configuration 5. Purge page and hosting caches, then check the live headers on cached and uncached pages ## FAQ ### Is Content-Security-Policy enabled by default? New installs enable a minimal enforced `Content-Security-Policy: upgrade-insecure- requests` on HTTPS responses. It upgrades HTTP resource URLs to HTTPS without adding script or other source restrictions. Resources unavailable over HTTPS will fail to load. You can disable it using the HTTPS resource upgrades checkbox. Existing installations keep their previous behaviour and must opt in to HTTPS resource upgrades after updating. Advanced CSP remains disabled by default because source restrictions need website-specific configuration. ### Should I use Report-Only mode first? Yes, for advanced CSP. Report-Only mode reports advanced policy issues without blocking resources. The separate HTTPS resource upgrades setting remains enforced even while advanced CSP is in Report-Only mode. When advanced CSP is enforced, the baseline directive is merged into that policy. ### Does this guarantee an A+ grade? No. A grade depends on the headers actually returned for each scanned URL and the scanner’s criteria. The minimal upgrade policy does not restrict script sources or provide the XSS protection of a carefully configured CSP. ### How do I use Discover / Review / Enforce? 1. Open Security Headers > Discover / Review / Enforce and acknowledge Start / Resume Discovery. On first use, this saves a settings backup and replaces advanced CSP with a same-origin Report-Only starter. This does not block advanced policy violations; the separate HTTPS upgrade baseline remains enforced if enabled. 2. Purge page, hosting, and CDN caches. Browse important pages and exercise forms, booking, chat, lazy loading, analytics, login roles, and consent states. HTML detection suggests scripts, styles, images, fonts, frames, media, and manifests. Browser reports provide additional origins for dynamic requests, CSS dependencies, APIs, and workers. The plugin does not fetch external JS/CSS files or execute JavaScript to crawl the site. 3. Review suggestions. Approve recognised required origins or reject unwanted suggestions. Unsafe inline/eval and broad data/blob script permissions require a separate risk acknowledgment; manually configured hashes/nonces can be preferable. Discovery never automatically includes sources in the policy. Existing manual CSP fields remain explicit configured permissions, so rejecting a suggestion does not override them. 4. Verify the public Report-Only policy for a same-site page path. The tool does not add cache-busting parameters or follow redirects. It requires HTTP 200 HTML with the matching policy. This confirms one response, not full site coverage. Approvals and policy changes invalidate verification. 5. With no pending suggestions, confirm browser testing and cached-page header coverage, then use Enforce Reviewed Policy. The fixed policy contains approved origins plus manual fields; it never expands based on HTML or public reports. Purge caches again and verify the enforced policy. Resume Report-Only testing before changing approvals. Use Restore Saved Settings to return to the full plugin configuration saved before the first workflow start. Normal settings saves cannot skip verification and directly enforce a changed reviewed policy. Imported settings are returned to Report-Only for retesting. ### Can discovery prove that every asset is safe? No. Detection is a compatibility aid, not a security audit. Public browser reports can be forged and are never treated as trusted approvals. The plugin may miss features not exercised, conditional requests, logged-in variations, and reports that do not arrive. Missing reports do not prove safety. Origin approvals permit more than a single file, and broad permissions in manual fields can weaken CSP. Discovery is capped at 250 source/directive pairs; reports are limited to 16 KB, 20 entries per batch, and 60 entries per client per minute. Limits can prevent complete observations. New installs use the reviewed-source workflow and disable automatic source inclusion. Existing installations keep legacy settings until an administrator explicitly starts discovery. Legacy automatic inclusion can also permit attacker-injected sources and is retained only for compatibility. ### Where are discovery data and browser reports stored? In bounded WordPress options on your own site, not in an external service unless you configure an external report endpoint. Page paths are stored without visitor query strings or fragments. Reports and source suggestions are untrusted. Removing the plugin through WordPress uninstall deletes its settings, reports, discovery, verification, and workflow backup options. ### Why are headers missing on cached pages? Page caches, hosting proxies, and CDNs can serve HTML without running WordPress. PHP headers cannot cover those responses. Apache rules can cover static cache files when Apache processes the plugin’s generated .htaccess rules, but Nginx does not read .htaccess. Ask your host to apply security headers at the cache-serving layer and avoid duplicate headers. Purging caches alone may not solve the issue if the cache bypasses WordPress again. Auto-detected advanced CSP requires WordPress to inspect rendered HTML. It cannot detect sources in a static cache response. Emergency CSP bypass also requires a WordPress-generated response and cannot bypass policies enforced by your server or CDN. ### Does HSTS work on HTTP sites? No. HSTS should only be enabled when your site is fully available over HTTPS. ## Anmeldelser ![](https://secure.gravatar.com/avatar/043fa4640ad96d725a6e59cff4538afca1f74558ac131a2c04fb537f032fec21? s=60&d=retro&r=g) ### 󠀁[Site Killer](https://wordpress.org/support/topic/site-killer-3/)󠁿 [nofarrell](https://profiles.wordpress.org/nofarrell/) 29. maj, 2023 No warning, no instruction of what to do if you site goes down, no configuration options, deleting the plugin directory does not resort your website. From my experience, unless you have hours with nothing better to do except rebuild your WordPress website, installing advise not to install this plugin ![](https://secure.gravatar.com/avatar/b6398168f573fac25a612a2eea6c89261fd77ca69cf66857f4df344d91b37a8a? s=60&d=retro&r=g) ### 󠀁[great work – A+ score indeed!!!!](https://wordpress.org/support/topic/great-work-a-score-indeed/)󠁿 [vevsglobal](https://profiles.wordpress.org/vevsglobalph/) 27. september, 2022 I installed the plugin. great work!!!!!! from F score to A+ score. Thank you for creating this plugin, t was really hard to do it on a htaccess file and server configuration stuff not familiar… and with this plugin i dont need to touch teh htaccess file, it works. [ Læs alle 2 anmeldelser ](https://wordpress.org/support/plugin/firstpage-sg-security-headers/reviews/) ## Bidragsydere & udviklere “Security Headers” er open source-software. Følgende personer har bidraget til dette plugin. Bidragsydere * [ Joseph Mendez ](https://profiles.wordpress.org/joshme21/) “Security Headers” er blevet oversat til 2 sprog. Tak til [oversætterne](https://translate.wordpress.org/projects/wp-plugins/firstpage-sg-security-headers/contributors) for deres bidrag. [Oversæt “Security Headers” til dit eget sprog.](https://translate.wordpress.org/projects/wp-plugins/firstpage-sg-security-headers) ### Interesseret i udvikling? [Gennemse koden](https://plugins.trac.wordpress.org/browser/firstpage-sg-security-headers/), tjek [SVN repository](https://plugins.svn.wordpress.org/firstpage-sg-security-headers/), eller abonner på [udviklerloggen](https://plugins.trac.wordpress.org/log/firstpage-sg-security-headers/) via [RSS](https://plugins.trac.wordpress.org/log/firstpage-sg-security-headers/?limit=100&mode=stop_on_copy&format=rss). ## Ændringslog #### 1.6.0 * Added a Discover / Review / Enforce admin workflow with explicit, nonce-protected source approvals. * Added HTML and browser-report suggestions for static and dynamic resource origins without automatic trust. * Added public Report-Only header verification, policy-change invalidation, and explicit enforcement confirmations. * Added iframe, media, worker, and manifest directive fields and a fixed-policy preview. * Preserved legacy settings on upgrade and saved pre-workflow settings for recovery. * Added modern Reporting-Endpoints/report-to support alongside report-uri and bounded Reporting API batches. * Hardened public reports with size, origin, rate, and source-validation limits. * Added cleanup for workflow data on uninstall. #### 1.5.0 * Added an independent enforced upgrade-insecure-requests baseline for HTTPS responses. * Enabled the baseline for new installs while preserving existing installations until they opt in. * Kept advanced CSP configurable and Report-Only testing independent of the baseline. * Merged the baseline into enforced advanced CSP without duplicating the directive. * Prevented static Apache baseline rules from overwriting auto-detected enforced advanced CSP. * Added HTTPS upgrade diagnostics, resource compatibility warnings, and cache guidance. #### 1.4.0 * Added best-effort CSP source detection from rendered HTML. * Added a built-in CSP violation report collector and browser-only emergency bypass. #### 1.3.0 * Added diagnostics and live header testing tools in wp-admin. * Added import, export, and reset tools for plugin settings. * Added a configurable Content-Security-Policy builder with Report-Only support. * Added uninstall cleanup for stored plugin options. #### 1.2.0 * Added a WordPress admin settings page under Settings > Security Headers. * Added saved plugin options with sanitization and safer defaults. * Connected PHP and Apache header output to the saved admin settings. #### 1.1.0 * Updated plugin metadata for modern WordPress compatibility. * Removed deprecated legacy headers. * Limited default headers to a conservative modern set to reduce breakage. * Only sends HSTS on HTTPS requests. #### 1.0.0 * First release ## Meta * Version **1.6.0** * Senest opdateret **3 dage siden** * Aktive installationer **700+** * WordPress-version ** 6.0 eller højere ** * Testet op til **6.9.8** * PHP-version ** 7.4 eller højere ** * Sprog * [English (US)](https://wordpress.org/plugins/firstpage-sg-security-headers/), [Spanish (Chile)](https://cl.wordpress.org/plugins/firstpage-sg-security-headers/) og [Spanish (Spain)](https://es.wordpress.org/plugins/firstpage-sg-security-headers/). * [Oversæt til dit sprog](https://translate.wordpress.org/projects/wp-plugins/firstpage-sg-security-headers) * Tag * [Security Headers](https://da.wordpress.org/plugins/tags/security-headers/) * [Avanceret visning](https://da.wordpress.org/plugins/firstpage-sg-security-headers/advanced/) ## Bedømmelser 3 ud af 5 stjerner. * [ 1 5-stjernet anmeldelse ](https://wordpress.org/support/plugin/firstpage-sg-security-headers/reviews/?filter=5) * [ 0 4-stjernet anmeldelser ](https://wordpress.org/support/plugin/firstpage-sg-security-headers/reviews/?filter=4) * [ 0 3-stjernet anmeldelser ](https://wordpress.org/support/plugin/firstpage-sg-security-headers/reviews/?filter=3) * [ 0 2-stjernet anmeldelser ](https://wordpress.org/support/plugin/firstpage-sg-security-headers/reviews/?filter=2) * [ 1 1-stjernet anmeldelse ](https://wordpress.org/support/plugin/firstpage-sg-security-headers/reviews/?filter=1) [Din anmeldelse](https://wordpress.org/support/plugin/firstpage-sg-security-headers/reviews/#new-post) [Se alle anmeldelser](https://wordpress.org/support/plugin/firstpage-sg-security-headers/reviews/) ## Bidragsydere * [ Joseph Mendez ](https://profiles.wordpress.org/joshme21/) ## Support Har du noget at sige? Har du brug for hjælp? [Vis supportforum](https://wordpress.org/support/plugin/firstpage-sg-security-headers/) ## Donér Vil du gerne støtte udviklingen af dette plugin? [ Donér til dette plugin ](https://paypal.me/jose88882020)