HTTP Headers adds CORS & security HTTP headers to your website.
As of April 2026, HTTP Headers is a WordPress csp header plugin with 50K+ active installations and a 4.3/5 rating from 70 reviews. It has been downloaded 718K+ times in total. Requires WordPress 3.2+ and PHP 5.3+. Available on WordPress.org since 2016. Last updated 1 year ago — may have compatibility concerns. Downloads are up 8% this week. Support resolution rate: 0%.
HTTP Headers gives your control over the http headers returned by your blog or website.
Headers supported by HTTP Headers includes:
Never use this plugin as the security settings make my main site and all sub-domain sites down and even after uninstallation / removal of everything and start to install a new WP, it doesn’t work anymore
worked exactly as promised except 2
Went through a bunch of options of adding security headers to my sites and settled on this plugin.
Would be 5 stars if two things get fixed/added. 1st is that it would be great to have a save button at the top also so you don’t have to scroll so much to the bottom to save options (especially on CSP screen). And the 2nd would be that the boxes where we are able to input sites etc, sometimes you have to paste numerous websites in that field and it is ridiculously annoying to try to scroll through, see whats already there or copy and paste outside in notepad for example and then paste it back in. Would be great if that field could be expanded or just bigger.
When used with Elementor, you can’t edit the pages. Had to uninstall, since I don’t know what else it will break.
I am finding this a very effective tool to help clients reach security compliance. There is one glitch I believe, however, is with the x-content-type-options. Once you enable this the only option is “nosniff”. And once enabled, there is no way to reset it. And unfortunately i believe this setting is creating errors on my site. I can’t even seem to find the line for it in my .htaccess file. Any recommendations?
| WordPress | 3.2+ requiredTested up to 6.7.5 |
| PHP | 5.3+ required |
Release Date – 22nd December, 2024
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.