by
fepo
0 (0 reviews)
fepo CSP & Security Headers
Scans your pages, builds one Content-Security-Policy and sends it with the other security headers. Nothing leaves your website.
fepo CSP & Security Headers ranks #68,852 among WordPress.org plugins with 0+ active installations, is #3,855 of 5,058 in the Security category, and was last updated Oct 29, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1.4
v1.0.2
Current Version v1.0.2
Updated 3 days ago
Last Update on 29 Oct, 2026
Refreshed 2 days ago
Last Refreshed on
#3,855 of 5,058 in Security
Actively maintained
Rank
#68,852
—
No change
Active Installs
0+
—
No change
KW Avg Position
51
—
No change
Downloads
76
+48 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
41,284
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 10 more installs to reach 10+
Rank Changes
Current
#68,852
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.2
- Last Updated
- Oct 29, 2026
- Requires WP
- 6.0+
- Tested Up To
- 7.1.4
- PHP Version
- 7.4 or higher
- Author
- fepo
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about fepo CSP & Security Headers
Yes. The scan runs in the browser tab where you started it. It keeps running while the tab is in the background, so you can work in another tab. If you close or reload the tab, the plugin page offers "Continue scan" and picks up where it stopped.
Cached pages may keep the headers they were stored with. Clear the cache after a scan and after changing headers. The plugin shows a hint when it detects a known cache plugin (WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround Optimizer, Cloudflare). My server or another plugin already sends a Content-Security-Policy. Then this plugin does not send its own policy, because browsers apply both policies and the stricter result can break your site. Remove the other header first; the "Policy" tab shows a warning as long as it is present. Other security headers that already exist are left alone in the same way.
Not in Report-Only mode: nothing is blocked, browsers only report. The plugin never switches to Enforce by itself, and a new scan does not change the mode once you chose Enforce. Switch to Enforce on the "Policy" tab when the "Reports" tab stays quiet; if something stops working, switch back to Report-Only and add the reported source.
Nothing changes on your site until you decide: the security headers stay off until you save the "Headers" tab or a scan finishes. The scan then switches on X-Content-Type-Options, Referrer-Policy and — if your server does not send it already — X-Frame-Options. Permissions-Policy stays off unless you switch it on, because it disables camera, microphone and location for your pages. If the plugin page says "Headers are not sent yet", your server could not load its own home page; the notice lists common causes.
When the plugin sends the headers itself, logged-in users do not get the policy: the admin bar and the block editor load their own inline code, which would otherwise fill the reports. Log out or use a private window to check the header. Headers sent by your web server behave differently: the .htaccess block (Apache, LiteSpeed Enterprise) and the configuration text for nginx, OpenLiteSpeed, Caddy and IIS reach every visitor, logged in or not, but they keep the policy away from wp-admin and the login page.
Nothing you have to do: the plugin sends all headers itself through WordPress, on any web server. The configuration text on the "Policy" tab is optional; with it, your web server sends the headers instead, also for files that WordPress does not deliver. Like the .htaccess block, the text sends the policy everywhere except wp-admin and the login page. If you use it, keep two things in mind. The plugin cannot change your server configuration, so copy the updated text again after a new scan or after adding a source from the "Reports" tab. As soon as your server sends a Content-Security-Policy, the plugin stops sending its own (click "Re-check headers" after changing the server). On nginx, also copy the lines into every location block that has add_header lines of its own, because nginx does not pass them on there.
Pages with WordPress JavaScript templates (wp.template), for example WooCommerce variable products, compile those templates at runtime. That needs 'unsafe-eval' in script-src, so the scan adds it when it finds such templates.
Many WordPress plugins print inline scripts that contain a nonce. Nonces change for every visitor and at least once a day, so a hash of such a script would be wrong for the next visitor. In that case, and when pages use inline event handlers such as onload="…", the policy allows inline code instead of listing hashes. Style attributes (style="…") have the same effect on style-src. With more than 30 different inline scripts or styles the header would get too long, so the policy uses 'unsafe-inline' there as well and the "Policy" tab says so.
No. The "Pages" tab marks posts that were edited after their last scan as "Changed since last scan" and new posts as "Not scanned yet". Use the "Rescan" button of a page or "Rescan all changed and new pages". A full scan from the "Scan" tab is still useful after you changed your theme or a plugin that affects every page.
A source is unused when no scanned page loads it any more, for example after you removed an embedded video. The plugin never removes sources by itself, because a page that was skipped during a scan or a page you did not rescan may still need it. Check the list and click "Remove" for the sources you no longer need. Sources of active payment providers and sources you added from the "Reports" tab are never listed as unused.
