/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ GD Security Headers

GD Security Headers

By Milan Petrovic

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

GD Security Headers Review - In-Depth Analysis

Configure various security-related HTTP headers for enhanced website security. Supports CSP, XSS, Referrer Policy, and more. Includes features for reporting and server compatibility.

Performance Overview

WPS Score

6.85/10

User Rating

4/5 (based on 8+ reviews)

Active Installations

1,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

6.53 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin allows you to configure various security-related HTTP headers to improve your website's security. It supports Content Security Policy (CSP), XSS Protection, Referrer Policy, and more. The plugin includes reporting features and can log reports from browsers.

Supported security headers include CSP with reporting, XSS Protection, Feature Policy, and more. You can set rules for all currently supported directives and additional settings for report or live mode.

The plugin also helps you automatically fill CSP rules for popular services like Google Fonts, Maps, and Analytics. It provides methods for adding headers into the HTACCESS file for Apache servers or generates headers for other server types like Nginx and IIS.

Comparing to Alternatives

GD Security Headers is a plugin focused on setting security headers with some unique features, but it faces competition from several other plugins offering similar functionalities.

Top alternatives

Strengths

Easy to install and configure, especially for Content-Security-Policy (CSP) rules.
Includes shortcuts for common rules like Google Analytics.
Offers a clear report-only feature to help gather CSP rules.
Local reporting feature is highly appreciated by users.
Good error support and explanations for headers.

Weaknesses

Known vulnerabilities in past versions, including XSS and SQLi, though fixed in recent updates.
Some users report mistakes in generated Content-Security-Policy statements.
Does not currently provide warnings about header size limits.
No pro version with advanced features is available.

User Sentiment Analysis

With a majority of 5-star ratings and a few 1-star complaints, users generally appreciate the plugin's ease of use and reporting features but have concerns about CSP generation errors.

Positive highlights

'Good Error Support!' — Anonymous User
'Very useful plugin' — nadeistos
'Does the business' — tszesty
'Extremely helpful' — nichu42

Common complaints

Generated Content-Security-Policy contains invalid characters in directive names.
Mistakes in the generated CSP, such as missing blob and data directives and incorrect punctuation.

Weaknesses

Past security vulnerabilities with high risk scores, though fixed in recent versions.
Some users find CSP generation error-prone and requiring manual fixes.
Lack of advanced features due to absence of a pro version.

Who Should Use This?

Best for

Users looking for a straightforward plugin to manage security headers with helpful reporting features and easy setup, especially those focusing on CSP rules.

Not ideal for

Users requiring a plugin with advanced security features or those concerned about past vulnerabilities might prefer alternatives with a stronger security track record and pro options.

Pricing & Value

Free version includes

The free version provides core functionality for setting security headers, including CSP management and reporting features.

Final Verdict

GD Security Headers offers a user-friendly approach to managing security headers with valuable reporting and easy configuration, making it a solid choice for many users. However, past security vulnerabilities and some issues with CSP generation suggest caution and careful updating.

While it lacks a pro version and some advanced features, it remains competitive among alternatives, especially for users prioritizing ease of use and local reporting. Users should weigh these factors against their security needs before choosing this plugin.

Other Notable Features

Here are a few other notable features of this free GD Security Headers plugin.

Content Security Policy

Csp

Permission Policy

Security

Screenshots

FAQ

Yes. In Multisite installation, the plugin is available for configuration on the Network level, and headers are configured for all sites in the network at once.