/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Headers Security Advanced & HSTS WP

Headers Security Advanced & HSTS WP

By Andrea Ferro

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Headers Security Advanced & HSTS WP Review - In-Depth Analysis

Headers Security Advanced & HSTS WP is a comprehensive security plugin for WordPress. It implements HTTP response headers to protect against vulnerabilities like XSS and clickjacking. The plugin ensures your site is secure with minimal effort.

Performance Overview

WPS Score

6.56/10

User Rating

4.9/5 (based on 79+ reviews)

Active Installations

90,000+

Update Frequency

Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

Headers Security Advanced & HSTS WP is a free plugin designed for all WordPress users. When deactivated, it restores your site to its previous configuration.

This plugin implements HTTP response headers that enhance your website's security. It automatically sets up best practices, preventing modern browsers from encountering predictable vulnerabilities. The goal is to increase awareness and usage of these headers among WordPress users.

Developed by TentaclePlugins, Headers Security Advanced & HSTS WP focuses on WordPress security and best practices.

Key features include protection against XSS, code injection, and clickjacking through various HTTP security headers. The plugin is based on the OWASP CSRF standard, providing full CSRF mitigation without additional methods. This ensures your site remains secure even with potentially vulnerable plugins.

With Headers Security Advanced & HSTS WP, you can customize Content Security Policy (CSP) rules for enhanced security. The plugin supports integration with various services for optimal monitoring and security management.

All features are available for free, and the plugin is regularly updated. Feedback is welcomed for improvements and compatibility issues.

Comparing to Alternatives

Headers Security Advanced & HSTS WP is a strong contender in the security headers plugin category, offering robust features with no recorded vulnerabilities. It competes with several other plugins that provide similar functionality.

Top alternatives

Strengths

High user rating with 92.4% five-star reviews
No known security vulnerabilities as per WPScan
Simple plug & play setup with customizable settings
Excellent developer support and responsiveness
Effectively improves security header scores on external testing sites

Weaknesses

May add more headers than necessary for some users
Reported to potentially slow page load times by a minority of users

User Sentiment Analysis

With an overwhelmingly positive rating of 4.9 out of 5 from 79 users, most feedback highlights the plugin's ease of use and effectiveness. Negative feedback is minimal but points to some performance concerns.

Positive highlights

"Fantastic Plugin!" - Ben
"Used it on 10+ websites, all work fine" - Eduard Doloc
"Great plugin, a must have" - pikapower
"Great plugin and even better developer!" - boxhamster
"Just works. beautiful" - amirse

Common complaints

Adds a lot of unnecessary headers that accomplish nothing
Seems to slow page load

Weaknesses

Potential impact on page load speed
May include more headers than some users find necessary

Who Should Use This?

Best for

Website owners and administrators seeking an easy-to-use, effective security headers plugin with strong developer support and no known vulnerabilities.

Not ideal for

Users who require minimal header additions or have strict performance constraints may find this plugin adds unnecessary headers and could impact page load times.

Pricing & Value

Free version includes

The free version provides comprehensive security header management with customizable options and excellent support.

Final Verdict

Headers Security Advanced & HSTS WP stands out as a reliable and highly rated plugin that effectively enhances website security through headers. Its ease of use and strong developer support make it an excellent choice for most WordPress users.

While a small number of users report performance concerns due to added headers, the lack of security vulnerabilities and the plugin's robust feature set make it a valuable tool. Those with very specific performance needs should consider this before installation.

Other Notable Features

Here are a few other notable features of this free Headers Security Advanced & HSTS WP plugin.

Headers Security

HSTS

CSP

Clickjacking

XSS Protection

Screenshots

FAQ

Report URI will monitor content security policy (CSP) violations and provide detailed reports on detected violations.

I chose Sentry, URIports, Datadog, and Report URI for integration with this plugin because they are highly reputable and functional platforms in the field of security monitoring. Here’s a brief overview of each:

Sentry

Sentry is a well-known platform for monitoring and tracking errors and exceptions in applications. It provides comprehensive tools for logging and analyzing JavaScript errors, making it an excellent choice for monitoring Content Security Policy (CSP) violations. By integrating with Sentry, users can benefit from detailed error reports and proactive issue resolution.

Datadog

Datadog is a powerful platform for monitoring infrastructure, applications, and logs. It offers extensive capabilities for tracking security and performance metrics, including CSP violations. The integration with Datadog allows users to gain insights into the health and security of their websites, providing real-time monitoring and alerting features that are essential for maintaining a secure and performant environment.

Report URI

Report URI is a dedicated service for collecting and analyzing security violation reports, including CSP, HPKP, and other security headers. It is designed specifically to handle large volumes of security reports and provide detailed analytics and visualizations. By using Report URI, users can easily monitor and analyze CSP violations, helping them to quickly identify and mitigate potential security threats.

Each of these platforms offers unique strengths and capabilities, making them ideal choices for comprehensive security monitoring and reporting. By integrating with these well-established services, we aim to provide users with reliable and effective tools to enhance the security of their WordPress websites.

URIports

URIports is a well-known platform for monitoring and tracking errors and exceptions in applications. It provides comprehensive tools for logging and analyzing JavaScript errors, making it an excellent choice for monitoring Content Security Policy (CSP) violations. By integrating with URIports, users can benefit from detailed error reports and proactive issue resolution.