WDD Header Security Guard

Manage and control HTTP security headers in WordPress safely — without breaking your themes, plugins, or caching systems like WP Rocket.

Built by Nasibul Alam · webdevdoer.com

Overview

WDD Header Security Guard gives you full control over the HTTP security headers your WordPress site sends to browsers. Toggle each header on or off, customise the values, apply ready-made presets, and keep a log of every change — all from a clean admin panel that adds nothing to your frontend.

ArchitectureOOP, singleton core, 18-file structure
Frontend impactNone — zero scripts loaded on the public site
Settings storageWordPress Options API (wdd_hsg_settings)
Caching compatibilityWP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache

Installation

  1. Upload the wdd-header-security-guard folder to /wp-content/plugins/.
  2. Activate the plugin from the Plugins screen in wp-admin.
  3. Go to Settings → Header Security to configure.
First time setup On activation, the plugin seeds safe Basic-mode defaults automatically. Nothing is sent until you visit the settings page and review what's enabled.

Security Headers

Each header can be switched on or off independently and customised where applicable.

HeaderPurposeDefault
X-Frame-Options Controls whether your site can be embedded in an iframe. Prevents clickjacking. On — SAMEORIGIN
X-Content-Type-Options Stops browsers from MIME-sniffing responses. Prevents content injection. On — nosniff
X-XSS-Protection Enables the browser's legacy XSS filter (older browsers only). On — 1; mode=block
Referrer-Policy Controls how much referrer data is shared when visitors follow a link. On — strict-origin-when-cross-origin
Content-Security-Policy Defines which resources the browser may load. The strongest defense against XSS. Off — advanced
Permissions-Policy Restricts which browser features (camera, mic, geolocation, etc.) your site can use. Off — advanced
Strict-Transport-Security Forces browsers to use HTTPS only, for the configured duration. Also known as HSTS. Off — advanced
⚠️ Strict-Transport-Security is permanent Once a browser receives this header, it will enforce HTTPS for the full max-age duration — even after you disable it. Only enable HSTS once you're certain your site is 100% HTTPS with a valid, renewing certificate. Adding the preload directive without first submitting your domain to hstspreload.org is not recommended.
⚠️ Content-Security-Policy can break things A misconfigured CSP can block scripts, styles, fonts, or embeds your site depends on. Always test on a staging environment before enabling in production.

Presets

Presets configure all headers at once. Applying one replaces your current header values — global options like debug mode and WP Rocket compatibility are left untouched.

🌿 Basic

Safe for any site. Fully compatible with every theme and caching setup.

  • X-Frame-Options: SAMEORIGIN
  • X-Content-Type-Options: nosniff
  • X-XSS-Protection: on
  • Referrer-Policy: balanced
  • CSP / Permissions-Policy / HSTS: off

🔒 Strict

Maximum security. May affect analytics, ads, or embeds — test first.

  • X-Frame-Options: DENY
  • Referrer-Policy: no-referrer
  • CSP: strict, self-only directives
  • Permissions-Policy: all features blocked
  • HSTS: 1 year + includeSubDomains + preload

⚡ Performance

Minimal overhead, tuned for high-traffic sites running WP Rocket.

  • X-Frame-Options: SAMEORIGIN
  • X-XSS-Protection: off
  • Referrer-Policy: balanced
  • HSTS: 1 year + includeSubDomains
  • CSP / Permissions-Policy: off

WP Rocket Compatibility

Headers are injected using the WordPress send_headers action — the correct, cache-aware hook. It fires early in the request lifecycle, before any output begins.

When WP Rocket serves a fully cached page, it does so through advanced-cache.php, which runs before WordPress finishes booting. That means PHP-injected headers are not present in cached responses served this way.

Request typeHeaders applied?
First visit / uncached pageYes
Logged-in usersYes
REST API / AJAX requestsYes
Fully cached WP Rocket pageNo — see below
For fully cached pages Add the same header values to your server config so they apply to every response regardless of caching: .htaccess on Apache, or your server block on Nginx. The plugin's Compatibility tab includes this guidance in context.

Enable WP Rocket Compatibility Mode on the Headers tab to let the plugin skip redundant injection attempts when it detects WP Rocket has already taken over the response.

Conflict Detection

The Compatibility tab scans your active plugins for others known to send security headers — Wordfence, Sucuri, iThemes Security, Shield Security, and a few more — and flags them so you can decide which plugin should own your headers.

Independently of that scan, every header injection also checks headers_list() at runtime. If a header has already been sent by anything else in the request, WDD Header Security Guard skips sending its own copy rather than duplicating it.

Activity Logs

Every settings save, preset application, and header toggle is recorded with a timestamp and the user who made the change. Logs are capped at the 100 most recent entries and stored in the options table — no custom database tables, no flat files.

Turn on Debug / Verbose Logging to additionally log each individual header injection event. Recommended for troubleshooting only — leave off in production.

Frequently Asked Questions

Will this break my site?

The Basic preset is safe for all WordPress sites. Strict mode enables Content-Security-Policy, which can break third-party scripts or embeds — always test on staging first.

Does it work with caching plugins other than WP Rocket?

Yes. LiteSpeed Cache, W3 Total Cache, and WP Super Cache are all detected and reported on the Compatibility tab.

Where is data stored?

Settings live in the wdd_hsg_settings option and logs in wdd_hsg_logs. No custom tables are created.

What happens on uninstall?

All plugin options are removed cleanly via uninstall.php, including on multisite installs.

Can I set a custom Content-Security-Policy?

Yes — the CSP and Permissions-Policy fields accept free-text directives. Tags are stripped automatically but the directive syntax itself is yours to write.

Changelog

VersionNotes
1.0.0 Initial release. Six core headers, three presets, WP Rocket compatibility mode, conflict detection, activity logging.
1.0.0+ Added Strict-Transport-Security (HSTS) support, including preset values and a permanence warning in the UI.