Headers Security Advanced & HSTS WP

Plugin · Free + paid

90,000+ active installs · Rated 4.8/5 · Updated September 4, 2026

Visit website

Sends HTTP security headers such as HSTS, Content-Security-Policy, X-Frame-Options and Permissions-Policy from WordPress, and can write matching rules to Apache or LiteSpeed config files. It checks its own site after changes to confirm the headers arrive. Suits site owners who want hardened headers without code; a paid Shield add-on is shown as locked in the free code, and the header settings can break scripts or embeds if set too strictly.

Pros

  • Sends HSTS, CSP, X-Frame-Options and Permissions-Policy from one settings page
  • Can write headers to Apache or LiteSpeed configuration
  • Self-check confirms the headers reach the browser

Cons

  • Strict CSP or frame rules can break third-party scripts and embeds
  • Paid Shield add-on tabs are shown as locked in the free code
  • Writing server config files needs care on shared hosting

Topics: Security plugins

Alternatives