by Andrea Ferro
4.9 (78 reviews)
Headers Security Advanced & HSTS WP
Best all-in-one WordPress security plugin, uses HTTP & HSTS response headers to avoid vulnerabilities: XSS, injection, clickjacking. Force HTTP/HTTPS.
Compatible with WP 7.0.1
v5.3.3
Current Version v5.3.3
Updated 1 week ago
Last Update on 07 Jul, 2026
Refreshed 10 hours ago
Last Refreshed on
Rank
#475
—
No change
Active Installs
90K+
—
No change
KW Avg Position
3
—
No change
Downloads
1.5M
+927 today
Support Resolved
0%
—
No change
Rating
98%
Review 4.9 out of 5
4.9
(78 reviews)
Next Milestone 100K
90K+
100K+
6
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 1,622 more installs to reach 100K+
Rank Changes
Current
#475
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
4.9
78 reviews
Overall
98%
5
72
(92%)
4
3
(4%)
3
1
(1%)
2
2
(3%)
1
0
(0%)
Tracked Keywords
Showing 5 of 5| Keyword | Position | Change | Type | Updated |
|---|---|---|---|---|
| hsts | 1 | — | Tag | 1 day ago |
| csp | 1 | — | Tag | 1 day ago |
| clickjacking | 3 | — | Tag | 1 day ago |
| headers | 5 | — | Tag | 1 day ago |
| headers security | 5 | — | Tag | 1 day ago |
Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Support Threads Overview
Resolved
Unresolved
3
Total Threads
0
Resolved
3
Unresolved
0%
Resolution Rate
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 5.3.3
- Last Updated
- Jul 07, 2026
- Requires WP
- 4.7+
- Tested Up To
- 7.0.1
- PHP Version
- 7.4 or higher
- Author
- Andrea Ferro
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 4.9
- Reviews
- 78
- Support Threads
- 3
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
7K+ installs
#2,739
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
30K+ installs
#989
Akismet Anti-spam: Spam Protection
5M+ installs
#7
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
5M+ installs
#9
Jetpack – WP Security, Backup, Speed, & Growth
3M+ installs
#18
Frequently Asked Questions
Common questions about Headers Security Advanced & HSTS WP
No. Headers add less than 1KB to each response. The plugin uses WordPress native hooks and Apache .htaccess. Zero database queries at page load for visitors.
Yes. The PHP method (wp_headers filter) works on any server. The .htaccess method is Apache-only, but the plugin automatically uses the PHP method on other servers.
Yes. Compatible with WP Super Cache, W3 Total Cache, LiteSpeed Cache, WP Rocket, and others.
Yes. Cloudflare passes through headers set by WordPress. If you also set headers in Cloudflare dashboard, use the "Resolve duplicate headers" option in Settings to avoid duplicates.
Your site needs all 6 scored headers present: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. The plugin configures all of these automatically.
Rarely. If another plugin sets the same headers, you may get duplicates. Use the "Resolve duplicate headers" checkboxes in Settings to fix this.
HTTP Strict Transport Security tells browsers to always use HTTPS. Even if someone types http://, the browser upgrades to https:// automatically. Prevents protocol downgrade attacks.
Minimum for preload: 31536000 (1 year). Recommended: 63072000 (2 years). Start with 86400 (1 day) to test, then increase.
Only if your entire domain (including all subdomains) works over HTTPS. Preload is hardcoded in browsers and difficult to undo. Removal takes months. Test thoroughly first.
CSP tells browsers which resources can load on your page. Anything not explicitly allowed is blocked. It is the strongest protection against XSS attacks.