by Alex Hedström 0 (0 reviews)

EssentialHeaders

Name: EssentialHeaders
Author: Alex Hedström

Adds the essential HTTP security headers WordPress leaves out—on every public site response.

EssentialHeaders ranks #21,396 among WordPress.org plugins with 40+ active installations, is #1,324 of 5,058 in the Security category, and was last updated Aug 28, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v1.0.2 Current Version v1.0.2

Updated 2 months ago Last Update on 28 Aug, 2026

Refreshed 1 week ago Last Refreshed on

#1,324 of 5,058 in Security Top 50% by installs

View on WordPress.org

Rank

#21,396

— No change

Active Installs

40+

+14.3%

KW Avg Position

27.5

— No change

Downloads

426

+1 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 50

Total Progress 70%

40+ 50+

1,386

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 3 more installs to reach 50+

Rank Changes

Current #21,396

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.2
Last Updated: Aug 28, 2026
Requires WP: 6.3+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: Alex Hedström

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

csp headers hsts http security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about EssentialHeaders

The default set is conservative. Content-Security-Policy is off by default because a strict CSP can block scripts or styles your theme needs. Enable CSP when you are ready to tune it.

No. Strict-Transport-Security is only sent when the visitor reaches the site over HTTPS.

Yes. The login screen is treated as a public response. wp-admin, AJAX, REST, GraphQL, and XML-RPC are excluded, so dashboards and APIs are not broken by a strict CSP.

No. The plugin only stores its own options and manages HTTP response headers on public responses.

EssentialHeaders removes PHP- and WordPress-managed instances at the latest applicable WordPress header hook. Another callback running afterward, a reverse proxy, or a web server can add the header again; remove it at that layer as well.