by Dimitar Ivanov 4.3 (70 reviews)

HTTP Headers

Name: HTTP Headers
Rating: 4.3 (70 reviews)
Author: Dimitar Ivanov

HTTP Headers adds CORS & security HTTP headers to your website.

HTTP Headers ranks #787 among WordPress.org plugins with 50,000+ active installations, is #101 of 4,518 in the Security category, a 4.3/5 rating from 70 reviews, and was last updated Apr 27, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Tested up to WP 6.9 (Current: 7.1)

v1.19.5 Current Version v1.19.5

Updated 4 months ago Last Update on 27 Apr, 2026

Refreshed 8 hours ago Last Refreshed on

#101 of 4,518 in Security Top 1% by installs Downloads -20.5% this week

View on WordPress.org

Rank

#787

-1 this week

Active Installs

50K+

-0.4%

KW Avg Position

0.2 better

Downloads

717.4K

+153 today

Support Resolved

— No change

Rating

86%

Review 4.3 out of 5

4.3 (70 reviews)

Next Milestone 60K

Total Progress 3.1%

50K+ 60K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 9,694 more installs to reach 60K+

Rank Changes

Current #787

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.3

70 reviews

Overall 86%

51 (73%)

5 (7%)

4 (6%)

5 (7%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

Resolution Rate

Security History

Source: WPVulnerability

8 known vulnerabilities on record · 3 in the last 24 months · checked 1 week ago

Apr 21, 2026 UNPATCHED

HTTP Headers [http-headers] <= 1.19.2 (unfixed)

CVE-2026-1379 · No fix released
Apr 21, 2026 UNPATCHED

HTTP Headers [http-headers] <= 1.19.2 (unfixed)

CVE-2026-4132 · No fix released
Apr 21, 2026 UNPATCHED

HTTP Headers [http-headers] <= 1.19.2 (unfixed)

CVE-2026-2717 · No fix released
Jul 13, 2023

HTTP Headers [http-headers] < 1.19.0

CVE-2023-37978 · Fixed in v1.19.0
Jul 13, 2023

HTTP Headers [http-headers] < 1.19.0

CVE-2023-37978 · Fixed in v1.19.0
Jul 10, 2023

HTTP Headers [http-headers] < 1.19.0

CVE-2023-37874 · Fixed in v1.19.0
Jun 19, 2023

HTTP Headers [http-headers] < 1.18.11

CVE-2023-1208 · Fixed in v1.18.11
Apr 24, 2023

HTTP Headers [http-headers] < 1.18.9

CVE-2023-1207 · Fixed in v1.18.9

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.19.5
Last Updated: Apr 27, 2026
Requires WP: 3.2+
Tested Up To: 6.9
PHP Version: 5.3 or higher
Author: Dimitar Ivanov

Support & Rating

Rating: ★ ★ ★ ★ ☆ 4.3
Reviews: 70
Support Threads: 1
Resolved: 0%

Keywords

Security Headers cors headers csp header custom headers http-headers

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,756

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security - Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

TL;DR

AI summary of the plugin's readme

This plugin is for website owners and administrators who need to control the HTTP headers their site sends. It lets them add CORS and security-related headers, such as Content-Security-Policy and X-Frame-Options, without editing server configuration files directly.