Plugin-tag: headers security