HTTP Headers

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

113 searches this plugin appeared in over the last 90 days, 18 listed. 95 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 92% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 23 days ago and a band this size takes about a year or more to cross, so the real count is still just under 50K.

1. ★★★★★ ysc711

   1.2y ago

   Never use this plugin as the security settings make my main site and all sub-domain sites down and even after uninstallation / removal of everything and start to install a new WP, it doesn’t work anymore

   Read on wp.org ↗
2. ★★★★★ fairshareitservices

   1.5y ago

   worked exactly as promised except 2

   Read on wp.org ↗
3. ★★★★★ sunb1

   1.6y ago

   Went through a bunch of options of adding security headers to my sites and settled on this plugin. Would be 5 stars if two things get fixed/added. 1st is that it would be great to have a save button at the top also so you don’t have to scroll so much to the bottom to save options (especially on CSP screen). And the 2nd would be that the boxes where we are able to input sites etc, sometimes you have to paste numerous websites in that field and it is ridiculously annoying to try to scroll through, see whats already there or copy and paste outside in notepad for example and then paste it back in. Would be great if that field could be expanded or just bigger.

   Read on wp.org ↗
4. ★★★★★ RipRapRob

   2.1y ago

   When used with Elementor, you can’t edit the pages. Had to uninstall, since I don’t know what else it will break.

   Read on wp.org ↗
5. ★★★★★ swampscrapper

   2.5y ago

   I am finding this a very effective tool to help clients reach security compliance. There is one glitch I believe, however, is with the x-content-type-options. Once you enable this the only option is “nosniff”. And once enabled, there is no way to reset it. And unfortunately i believe this setting is creating errors on my site. I can’t even seem to find the line for it in my .htaccess file. Any recommendations?

   Read on wp.org ↗
6. ★★★★★ Jonathan Jewell

   2.5y ago

   I have felt this has been excellent since the first time I used it, and absolutely no issues with it for what it is, except that there are a couple of headers that either need to be ‘marked deprecated’ or just removed. My immediate spot of these are the, Features header, P3P header and the Expect-CT (which is still around, but Mozilla recommend not using). There may be others. There are a bunch of things that I might suggest as improvements, but this is to move the tool forward a bit. For instance: It would be great if it could display the highlighted state of the current Apache/Nginx code and the status of the security (as per securityheaders.com form) alongside/under it, so you could see the evolution of the security header set up arrangements as you add/remove them. Could be useful to have some in-built documentation on these things (particularly with the P3P header, those little summary items were impossible to figure out without going back and forth, but for other things like cache-control, or accept-expose-headers, some labelling could help). That said, for advanced users anyway, so perhaps less important. Further to that, it might be useful to have an indication of what OWASP, Scott Helme, and Mozilla recommend and/or warnings for ones that are problematic for security or high risk with labels on them. There are a few things that have odd formatting, so it is not obvious how to transpose the information for the reporting one over from how the header is laid out, since there are different ones for this. In this you have the report header that is normally used (as per report-uri site from Scott Helme) but it does not fit there. However, it has a group called ‘csp-element’ or something similar that might be clearer as to its use elsewhere). There is also the display of custom headers that are all grouped into one thing, and not spread out in a useful way if you want to review them. Odd grouping in a couple of places, so custom headers I might have given its own block for instance, and to have two items in one and even one in one grouping is a bit pointless. On another note, it is a shame that there is not a tool that is so effective that does this kind of thing for WordPress and just outputs the BIND9 detail for DNS resource records. A combination of this and that, with the ability to adjust PHP and Apache settings would be the most amazing tool ever. For what this does, however, is sets the foundations for a great security setup.

   Read on wp.org ↗
7. ★★★★★ robertorefresh

   2.5y ago

   Simply and useful

   Read on wp.org ↗
8. ★★★★★ j0s6h

   2.6y ago

   Great tool. Novices, beware, the myriad of settings is a bit daunting at first so you need to dive into the subtleties of Header settings, specifically the ones that address security settings for your site. A good resource for the broad variety of settings for Content Security Policy as well as other important Header settings such as X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, Referrer-Policy and Permissions Policy can be found at cheatsheetseries owasp org. Take your time working out which settings work best for your site. Getting a good rating at securityheaders com will reward you for your efforts. While the tool respects your initial .htaccess content it’s a good idea to backup your .htaccess before saving and applying the plugins settings.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.19.5 Release Date – 27th April, 2026 Fixed: Global updated_option Nonce Redirect Bug 1.19.5
2. — Version 1.19.4 Release Date – 25th April, 2026 Security vulnerabilities addressed Coding best practices applied 1.19.4
3. — Version 1.19.3 Release Date – 25th April, 2026 Security vulnerabilities addressed Coding best practices applied 1.19.3
4. — Version 1.19.2 Release Date – 22nd December, 2024 Added “script-src-elem” directive to “Content-Security-Policy” header Added “script-src-attr” directive to “Content-Security-Policy” header Added “style-src-elem” directive to “Content- 1.19.2
5. — Version 1.19.1 Release Date – 2nd September, 2023 Added “clientHints” directive to “Clear-Site-Data” header Added “credentialless” directive to “Cross-Origin-Embedder-Policy” header 1.19.1
6. — Version 1.19.0 Release Date – 7th July, 2023 Fixed: SSRF vulnerability by an Admin user Fixed: XSS vulnerability by an Admin user 1.19.0

1 open vulnerability affects the current version (1.19.6). 6 of 7 disclosed are patched.

1. Patched High · 7.2 HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters ↗
   2026-04-21 CVE-2026-4132 External Control of File Name or Path Affects <= 1.19.2 Patched in 1.19.3
2. Open Medium · 5.5 HTTP Headers <= 1.19.5 - Authenticated (Administrator+) CRLF Injection via Custom Header Values ↗
   2026-04-21 CVE-2026-2717 Improper Neutralization of CRLF Sequences Affects <= 1.19.5 No patch available
3. Patched Medium · 4.4 HTTP Headers <= 1.19.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting ↗
   2026-04-21 CVE-2026-1379 Improper Neutralization of Input During Web Page Generation Affects <= 1.19.4 Patched in 1.19.5
4. Patched Medium · 5.5 HTTP Headers <= 1.18.11 - Server-Side Request Forgery ↗
   2023-07-13 CVE-2023-37978 Server-Side Request Forgery Affects <= 1.18.11 Patched in 1.19.0
5. Patched Medium · 4.4 HTTP Headers <= 1.18.11 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2023-07-10 CVE-2023-37874 Improper Neutralization of Input During Web Page Generation Affects <= 1.18.11 Patched in 1.19.0
6. Patched Medium · 6.6 HTTP Headers <= 1.18.10 - Authenticated(Administrator+) Remote Code Execution ↗
   2023-06-19 CVE-2023-1208 Improper Control of Generation of Code Affects <= 1.18.10 Patched in 1.18.11
7. Patched Medium · 6.6 HTTP Headers <= 1.18.8 - Authenticated(Administrator+) SQL Injection ↗
   2023-04-24 CVE-2023-1207 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.18.8 Patched in 1.18.9

Translated into 11 languages, 4 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-10-10 50K+ → 40K+ down after 11 days in tier
2. 2026-09-29 40K+ → 50K+ up after 1 days in tier
3. 2026-09-28 50K+ → 40K+ down after 627 days in tier
4. 2025-01-09 40K+ → 50K+ up after 1 days in tier
5. 2025-01-08 50K+ → 40K+ down after 2 days in tier
6. 2025-01-06 40K+ → 50K+ up after 1 days in tier
7. 2025-01-05 50K+ → 40K+ down after 1 days in tier
8. 2025-01-04 40K+ → 50K+ up after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for HTTP Headers into a readme, a review or a deck. It updates itself.

HTTP Headers: 40K+ active installs, 4.3★ (70 reviews). Plugin Pulse (WP Mayor), as of 2026-11-02. https://plugins.wpmayor.com/plugin/http-headers