About this plugin
Jeelsh HTTP Headers gives you an easy-to-use interface inside your WordPress dashboard to set HTTP response headers that improve your site’s security and compliance.
With this plugin you can configure:
- Content-Security-Policy (CSP) headers
- HTTP Strict Transport Security (HSTS)
- Referrer-Policy
- X-Frame-Options
- Permissions-Policy
- X-Content-Type-Options
- X-Permitted-Cross-Domain-Policies
- Your own custom headers
All settings are validated and applied safely without touching your site’s core files.
Features
- Intuitive React-based admin panel
- Predefined security headers with helpful descriptions
- Custom header support
- Settings validation before saving
- Works out of the box with pre-built assets
- No external service dependencies by default
Requirements
- WordPress 5.0 or higher
- PHP 7.4 or higher
External Services
This plugin does not connect to any third-party service by default. The following items are documented for transparency:
-
CSP report-uri: If you configure a report-uri in the CSP settings, the browser will send CSP violation reports to the user-provided URL. The plugin does not provide or operate that endpoint; the site administrator chooses and controls it. By default the report-uri field is empty and no reports are sent.
-
com use IANA-reserved example domains as placeholders only. The plugin does not connect to them.
-
com/jeelsh/http-headers. It opens only when a user clicks it. com/en/site-policy/privacy-policies/github-privacy-statement.
-
com link. It opens the user’s email client; the plugin does not send any data.
-
php. These are same-site, internal communications.
Privacy
Jeelsh HTTP Headers does not collect, store, or transmit any personal data on its own. All header configuration is stored in your WordPress database. The only optional external communication is a CSP report-uri that you, the site administrator, choose to configure.
Support
com/jeelsh/http-headers
com.
Development
The plugin’s user interface is built with React. com/jeelsh/http-headers
md.