About this plugin
Computernørden’s Security Panel helps you secure your WordPress site with clear, guided tools — no deep technical knowledge required. Its Security Center shows how well your site is protected and what to do next, in plain language.
What it does
- HTTPS & HSTS — makes sure visitors always reach your site over an encrypted connection.
- Security headers — switches on browser protections against framing, content-sniffing and referrer leaks.
- Content Security Policy builder — a visual, per-directive editor with a safe Test mode, per-request nonces, hash allowlisting, and a violation log that helps you tighten the policy from real traffic without breaking your site.
- security.txt — publishes and maintains a valid /.well-known/security.txt (RFC 9116), keeping the expiry date fresh automatically, with optional PGP-signed content.
- Readiness scanner — checks common hardening settings (debug output, file editing, upload execution and more) and offers one-click fixes where it’s safe to apply them.
- Infrastructure checks — detects findings that live below WordPress (CAA DNS records, certificate key strength, HTTP compression, DANE) and explains exactly how to fix each in your own hosting environment.
The plugin aims for a clean result on public security scanners and gives self-contained, environment-aware guidance for anything it cannot change directly.
External services
This plugin performs security diagnostics by connecting to your own website’s domain and public DNS records. It does not send your data to any third-party company, analytics service, or the plugin author. txt maintenance task runs).
Specifically:
- TLS probe — the plugin makes HTTPS requests to your own site’s hostname to detect which TLS protocol versions your server accepts. The request goes to your domain only; the URL is your own site’s home URL. No request body or personal data is sent beyond a standard request and a plugin User-Agent string.
- Infrastructure checks — the plugin queries public DNS records for your own domain (CAA and TLSA/DANE records via DNS), opens a TLS connection to your own domain to inspect its certificate, and makes one HTTPS request to your own site to check whether HTTP compression is enabled. All targets are your own domain.
Because every connection targets your own site and public DNS, there is no third-party service, terms of service, or privacy policy involved. g. Cloudflare), these probes reach that provider’s edge, as any external visitor’s would.