HTTP Headers
HTTP Headers adds CORS & security HTTP headers to your website.
Use with caution
HTTP Headers works, but test it on a staging site before relying on it in 2026. It runs on 50K+ sites, is rated 4.3/5 and was last updated 5 months ago, and scores 55/100 on our health check.
- Proven at scale on 50K+ active sites
- Only tested up to WordPress 6.9 (latest is 7.1)
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where HTTP Headers stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| cors headers | #1 |
| csp header | #2 |
| custom headers | #7 |
| http-headers | #1 |
| Security Headers | #11 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 4.3 from 70 reviews
About HTTP Headers
From the official readme · v1.19.5Description
HTTP Headers gives your control over the http headers returned by your blog or website.
Headers supported by HTTP Headers includes:
- Access-Control-Allow-Origin
- Access-Control-Allow-Credentials
- Access-Control-Max-Age
- Access-Control-Allow-Methods
- Access-Control-Allow-Headers
- Access-Control-Expose-Headers
- Age
- Content-Security-Policy
- Content-Security-Policy-Report-Only
- Cache-Control
- Clear-Site-Data
- Connection
- Content-Encoding
- Content-Type
- Cross-Origin-Embedder-Policy
- Cross-Origin-Opener-Policy
- Cross-Origin-Resource-Policy
- Expect-CT
- Expires
- Feature-Policy
- NEL
- Permissions-Policy
- Pragma
- P3P
- Referrer-Policy
- Report-To
- Strict-Transport-Security
- Timing-Allow-Origin
- Vary
- WWW-Authenticate
- X-Content-Type-Options
- X-DNS-Prefetch-Control
- X-Download-Options
- X-Frame-Options
- X-Permitted-Cross-Domain-Policies
- X-Powered-By
- X-Robots-Tag
- X-UA-Compatible
- X-XSS-Protection
Installation
Upload the HTTP Headers plugin to your blog. Then activate it.
That’s all.
Frequently asked questions
Why to use this plugin?
Nowadays security of your social data at the web is essential. This plugin helps you to improve your website overall security.
Who use these headers?
These HTTP headers are being used in production services by popular websites as Facebook, Google+, Twitter, LinkedIn, YouTube, Yahoo, Amazon, Instagram, Pinterest.
Changelog
Updates are on they way, so stay tuned at @DimitarIvanov
1.19.5
Release Date – 27th April, 2026
- Fixed: Global updated_option Nonce Redirect Bug
1.19.4
Release Date – 25th April, 2026
- Security vulnerabilities addressed
- Coding best practices applied
1.19.3
Release Date – 25th April, 2026
- Security vulnerabilities addressed
- Coding best practices applied
1.19.2
Release Date – 22nd December, 2024
- Added “script-src-elem” directive to “Content-Security-Policy” header
- Added “script-src-attr” directive to “Content-Security-Policy” header
- Added “style-src-elem” directive to “Content-Security-Policy” header
- Added “style-src-attr” directive to “Content-Security-Policy” header
1.19.1
Release Date – 2nd September, 2023
- Added “clientHints” directive to “Clear-Site-Data” header
- Added “credentialless” directive to “Cross-Origin-Embedder-Policy” header
1.19.0
Release Date – 7th July, 2023
- Fixed: SSRF vulnerability by an Admin user
- Fixed: XSS vulnerability by an Admin user
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
FAQ
HTTP Headers: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Sep 26, 2026
Is HTTP Headers free?
Yes. HTTP Headers is free to download and use from the official WordPress.org plugin directory.
Is HTTP Headers safe to use in 2026?
HTTP Headers works, but test it on a staging site before relying on it in 2026. It runs on 50K+ sites, is rated 4.3/5 and was last updated 5 months ago, and scores 55/100 on our health check.
How many websites use HTTP Headers?
HTTP Headers is active on 50K+ WordPress websites and has been downloaded 786,462 times since it launched in May 2016. It was downloaded 5,826 times in the last 30 days.
Does HTTP Headers work with WordPress 7.1?
HTTP Headers is officially tested up to WordPress 6.9.9, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
What PHP version does HTTP Headers need?
HTTP Headers requires PHP 5.3 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was HTTP Headers last updated?
The latest version, 1.19.5, was released on April 27, 2026 (5 months ago).
Who makes HTTP Headers?
HTTP Headers is developed and maintained by Dimitar Ivanov.
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
