/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ HTTP Headers

HTTP Headers

By Dimitar Ivanov

Security & Privacy / Security Scanning & Malware Protection

HTTP Headers Review - In-Depth Analysis

HTTP Headers adds CORS and security HTTP headers to your website. Control the headers returned by your blog or website easily.

Performance Overview

WPS Score

6.53/10

User Rating

4.3/5 (based on 70+ reviews)

Active Installations

50,000+

Update Frequency

Average It is calculated using the weighted average of same category plugins.

Security Score

4.2 / 10 (Low Risk) It is calculated using the weighted average of all versions.

What It Does

HTTP Headers gives you control over the http headers returned by your blog or website.

Headers supported by HTTP Headers includes Access-Control-Allow-Origin, Access-Control-Allow-Credentials, Access-Control-Max-Age, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Expose-Headers, Age, Content-Security-Policy, Content-Security-Policy-Report-Only, Cache-Control, Clear-Site-Data, Connection, Content-Encoding, Content-Type, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Expect-CT, Expires, Feature-Policy, NEL, Permissions-Policy, Pragma, P3P, Referrer-Policy, Report-To, Strict-Transport-Security, Timing-Allow-Origin, Vary, WWW-Authenticate, X-Content-Type-Options, X-DNS-Prefetch-Control, X-Download-Options, X-Frame-Options, X-Permitted-Cross-Domain-Policies, X-Powered-By, X-Robots-Tag, X-UA-Compatible, and X-XSS-Protection.

Comparing to Alternatives

HTTP Headers is a straightforward plugin focused on managing security headers in WordPress. Compared to other security header plugins, it offers a basic but effective approach without advanced integrations.

Top alternatives

HTTP Headers

Strengths

Simple and easy to use interface.
Effectively sets foundational security headers.
Lightweight without unnecessary features.
Free to use without upsells.

Weaknesses

Lacks advanced features like header status visualization.
No in-built documentation or guidance on headers.
Limited customization for custom headers.
No integration with security recommendations from OWASP or Mozilla.

User Sentiment Analysis

User feedback highlights the plugin's effectiveness but also points out areas needing improvement and compatibility issues.

Positive highlights

"An exceptional plugin – needs updating" (Jonathan Jewell)
"Very effective tool to help clients reach security compliance" (swampscrapper)
"Easy to use and almost perfect" (sunb1)
"Worked exactly as promised" (fairshareitservices)

Common complaints

Compatibility issues with Elementor causing editing problems.
Inability to reset certain header options like x-content-type-options.
UI inconveniences such as lack of save button at the top and small input fields.
Security settings causing site downtime in some cases.

Weaknesses

No option to mark deprecated headers or remove outdated ones.
Odd grouping and formatting of custom headers.
Lack of warnings or recommendations for risky headers.
No clear way to view header status evolution.

Who Should Use This?

Best for

Users seeking a simple, free plugin to manage basic HTTP security headers without complex features.

Not ideal for

Those needing advanced header management, detailed guidance, or compatibility with page builders like Elementor.

Pricing & Value

Free version includes

The free version includes the ability to add and manage various HTTP security headers with a straightforward interface, suitable for foundational security setups.

Final Verdict

HTTP Headers is a solid, no-frills plugin that effectively handles essential security headers for WordPress sites. It is best suited for users who want a lightweight and free solution without the need for advanced features or integrations.

However, it lacks modern enhancements, detailed guidance, and compatibility with some popular page builders, which may limit its usefulness for more complex or evolving security needs.