Skip to main content
Alex Hedström

Plugin

Essential Headers

Manage your site’s HTTP security headers in WordPress.

What it does

Essential Headers brings a small but important part of site hardening into one settings screen. Review the headers your site sends, switch protections on or off, and tune their values without burying them in server configuration. It focuses on public responses rather than changing your content.

Key features

  • Controls for Content-Security-Policy, HSTS, and X-Frame-Options.
  • X-Content-Type-Options, Referrer-Policy, and Permissions-Policy settings.
  • Removal or replacement of WordPress- and PHP-managed X-Powered-By values.
  • A Headers overview showing which protections are enabled.
  • Conservative defaults, with CSP left off until you are ready to tune it.
  • Public-page, feed, and login-screen coverage; admin and API responses are excluded.

Get started in three steps

  1. Install and activate Essential Headers, then open Settings → EssentialHeaders.
  2. Review the Headers overview and adjust individual values on the Settings tab.
  3. Test your public pages and login screen. Enable CSP only after checking the script, style, and other sources your site needs.

Frequently asked questions

No. A strict CSP can block scripts or styles your site needs, so it stays off until you configure and test it.

No. The plugin sends Strict-Transport-Security only over HTTPS. Add subdomain coverage only when every subdomain is ready.

No. wp-admin, AJAX, REST, GraphQL, and XML-RPC are excluded. The login screen is treated as a public response.

It can remove PHP- and WordPress-managed instances at the applicable WordPress hooks. A web server, proxy, or later callback can add the header again and needs its own configuration.

Need a hand?

Ask a question or check existing topics in the plugin’s WordPress.org support forum.

Plugin support

More plugins to explore

← All plugins

Contact

Got a project?

I help with WordPress websites and plugins. Tell me what you need, and I’ll write back.

Secret Link