PluginScout

GD Security Headers — WordPress Security Plugin

by Milan Petrovic · WordPress.org page · Website

v1.9 Tested up to WP 7.0.4 PHP 7.4+

GD Security Headers has 1,000+ active installs on WordPress.org and 34,873 downloads all time. We have tracked it since September 4, 2026; download trends appear after 30 days of data. The last update was on May 12, 2026, tested up to WordPress 7.0.4.

GD Security Headers at a glance

Active installs
1,000+
Total downloads
34,873
Downloads, last 30 days
–
available after 30 days of tracking
30-day growth
–
tracking since September 4, 2026

Is GD Security Headers well maintained?

Support threads resolved
No open threads
nothing waiting on the WordPress.org forum
WordPress compatibility
Behind
tested up to WordPress 7.0.4, not yet with the current 7.1

Features

The feature list from the plugin's own readme on WordPress.org, trimmed to the essentials.

  • Content Security Policy (CSP) – with reporting
  • XSS Protection (XXP) – with reporting
  • Feature Policy (Permissions Policy)
  • Content Type – No Sniff Policy
  • Strict Transport Security
  • Referrer Policy
  • Frame Options

GD Security Headers reviews and ratings

8 reviews on WordPress.org, with the most recent ones as their authors posted them.

All reviews
4.0 out of 5

8 reviews

5★
6
4★
0
3★
0
2★
0
1★
2

  • Extremely helpful

    It's the best plug-in for setting security headers that I found so far. Easy set-up, good explanations.But what really stands out is the local reporting feature! Thank you very much!

    nichu42

  • Does the business

    Easy to install and relatively easy to configure.I only want to set CSP rules and it lets me do that easily, having the shortcuts for common rules such as Google Analytics etc is useful.The report-only features is clear and easy to use when starting to add rules and you need to gather a list of them.If had had one feature request it would be for the plugin to show an estimated header size.. I sometimes trip header size limits on a server when I need to add a lot of rules. If it coudl detect the server limit and warn if getting close - that'd be nice.All in all good plugin. Really dont know why some people only gave it 1 star, I can only assume they made mistakes configuring it.

    tszesty

  • Very usefull plugin

    A+ on headers scan, thank you for your work :)

    nadeistos

  • Good Error Support!

    Thank you!

    Anonymous User

  • A lot of mistakes in the generated CSP

    There are a lot mistakes in the generated Content-Security-Policy statement. It fails to insert the blob and data directives. It adds a semicolon and double quote at the end of the line that shouldn't be there. The only thing this plugin is really good for is the report page.

    mesmer7

  • invalid characters

    The Content-Security-Policy directive 'script-src' contains 'script-src' as a source expression. Did you want to add it as a directive and forget a semicolon? The Content-Security-Policy directive name 'widget.gleamjs.io' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names. The Content-Security-Policy directive name 'www.googletagservices.com' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names. etc etc etc

    advertino

Where GD Security Headers ranks on WordPress.org

The rankings we track that GD Security Headers appears in, and how its position changed over 30 days.

Ranking WordPress.org placement Position 30 days
Best Security Plugins #42 in search, not tagged #73 –

GD Security Headers alternatives

Plugins that solve the same problem, ranked by how closely they overlap with GD Security Headers.

All GD Security Headers alternatives

Details

Configure various security-related HTTP headers, including CSP, XSS, Referrer Policy and more.

The full description, screenshots and every review live on the WordPress.org page.

Rankings GD Security Headers competes in

Tags

  • content security policy
  • csp
  • dev4press
  • permission policy
  • security

More from Milan Petrovic

Version
1.9
Last updated
May 12, 2026
First published
Mar 28, 2019
Requires WordPress
5.5
Tested up to
7.0.4
Requires PHP
7.4
Pricing
Free on WordPress.org

GD Security Headers FAQ

What does GD Security Headers do?

According to its WordPress.org readme, GD Security Headers offers Content Security Policy (CSP) – with reporting, XSS Protection (XXP) – with reporting, Feature Policy (Permissions Policy), Content Type – No Sniff Policy and Strict Transport Security.

How many active installs does GD Security Headers have?

WordPress.org reports 1,000+ active installs for GD Security Headers as of September 7, 2026.

Is GD Security Headers still maintained?

Yes. The last release was on May 12, 2026 and it is tested up to WordPress 7.0.4.

Is GD Security Headers free?

GD Security Headers is free to install from WordPress.org. Many plugins also sell a paid version or add-ons.

Where does GD Security Headers rank among Security Plugins?

GD Security Headers is #73 in the WordPress.org Security Plugins ranking.