Active installationsNewAdoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records 360 Orbit Header Security version 1.0.30 as active, updated 10d ago and tested up to WordPress 7.1.
Overview
About this plugin
Header Security brings your website up to date with current HTTP security headers:
Strict-Transport-Security (HSTS)
X-Frame-Options and CSP frame-ancestors (clickjacking protection, even without a full CSP)
Cookie hardening: adds missing Secure and SameSite attributes to all cookies the website sends
Optional 301 redirect from HTTP to HTTPS
Each header can be switched on and off individually, and its values are fully configurable. A quickstart button enables the recommended settings with a single click.
Free vs. Pro
The free version fully covers all of the basic headers listed above for the frontend.
Header Security Pro adds:
Content Security Policy (CSP), including a report-only mode for a low-risk start.
Learning mode: collects everything the CSP would block for a configurable period and only switches to enforcing once no finding is left unreviewed.
A scanner that automatically detects the external services your site needs (scripts, styles, images, fonts, iframes) and presents them for approval, including bulk approve/block.
Separate header configuration for the backend (wp-admin); WordPress’s own services are allowed automatically.
One address for your site: redirects the other spelling (with or without “www.”) to the address set in WordPress.
Option to load http:// sub-resources over https (upgrade-insecure-requests) as part of the Content Security Policy.
Automatic update notifications directly in the WordPress backend.
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
http headers
security headers
clickjacking
hsts
Compatibility & maintenance
Compatibility & maintenance
Tested with WP 7.1
Marked as tested with the current WordPress 7.1 release.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to7.1
Minimum requirementsWordPress 6.4 · PHP 8.1
Update activity22 Oct 202610d ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
Version1.0.28→1.0.30
Version1.0.27→1.0.28
Version1.0.26→1.0.27
Version1.0.23→1.0.26
WordPress compatibility7.1.2→7.1.3
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
