HTTP Headers
HTTP Headers adds CORS & security HTTP headers to your website.
- Active installs
- 40,000+
- #798 of 1,000
- Downloads, all time
- 822K
- 821,971
- Downloads, 30 days
- 34.8K
- 6K in the last 7
- Rating
- 4.3 / 5
- 70 reviews
- Last updated
- 15 days ago
- Oct 16, 2026
- Version
- 1.19.6
- 61 releases
Upkeep and compatibility
| Last updated | October 16, 2026Updated in the last 3 months |
|---|---|
| Tested up to | WordPress 7.1.4Covers WordPress 7.1.4, the current release |
| Needs WordPress | 3.6 or newer |
| Needs PHP | 5.3 or newer |
| First published | May 10, 2016 |
| Support, last two months | 1 of 3 threads resolved (33%) |
Reviews
4.3 / 5 from 70 reviews
| 5 stars | 51 |
|---|---|
| 4 stars | 5 |
| 3 stars | 4 |
| 2 stars | 5 |
| 1 star | 5 |
Downloads, last 30 days
What the author says it does
HTTP Headers gives your control over the http headers returned by your blog or website.
Headers supported by HTTP Headers includes:
- Access-Control-Allow-Origin
- Access-Control-Allow-Credentials
- Access-Control-Max-Age
- Access-Control-Allow-Methods
- Access-Control-Allow-Headers
- Access-Control-Expose-Headers
- Age
- Content-Security-Policy
- Content-Security-Policy-Report-Only
- Cache-Control
- Clear-Site-Data
- Connection
- Content-Encoding
- Content-Type
- Cross-Origin-Embedder-Policy
- Cross-Origin-Opener-Policy
- Cross-Origin-Resource-Policy
- Expect-CT
- Expires
- Feature-Policy
- NEL
- Permissions-Policy
- Pragma
- P3P
- Referrer-Policy
- Report-To
- Strict-Transport-Security
- Timing-Allow-Origin
- Vary
- WWW-Authenticate
- X-Content-Type-Options
- X-DNS-Prefetch-Control
- X-Download-Options
- X-Frame-Options
- X-Permitted-Cross-Domain-Policies
- X-Powered-By
- X-Robots-Tag
- X-UA-Compatible
- X-XSS-Protection
The opening of the plugin's own description. The full text, installation notes and changelog are on its WordPress.org page.
Questions the author answers
Why to use this plugin?
Nowadays security of your social data at the web is essential. This plugin helps you to improve your website overall security.
Who use these headers?
These HTTP headers are being used in production services by popular websites as Facebook, Google+, Twitter, LinkedIn, YouTube, Yahoo, Amazon, Instagram, Pinterest.
Latest changelog entry
Release Date – 16th October, 2026
- Security vulnerabilities addressed
- Coding best practices applied
Screenshots
This screenshot shows up the dashboard with categories of the supported headers. 
This screenshot shows up the headers of a chosen category and their current values. 
This screenshot shows up the settings page where you can adjust the security headers. 
This screenshot shows up the response headers returned by the web server.
Tagged
Where this page's numbers come from
Read from the WordPress.org plugin API on , when WordPress 7.1.4 was the current release. WordPress.org rounds active installs into buckets. These are the directory's figures, not my verdict, and I haven't tested this plugin. The author takes donations at their donate page.