Secure HTTP Headers — WordPress Security Plugin

Secure HTTP Headers at a glance

Is Secure HTTP Headers well maintained?

• HTTP Strict Transport Security – helps to protect websites against man-in-the-middle attacks and cookie hijacking
• X-Frame-Options – helps to protect users against ClickJacking attacks
• X-Content-Type-Options – helps to prevent the browser from MIME-sniffing
• Referrer-Policy – helps to control how much referrer information should be included with requests
• Clear-Site-Data – helps to ensure that data is deleted from the browser if the user logs out
• X-Download-Options – helps to control how IE 8 will handle downloaded HTML files
• Access-Control-Allow-Origin – helps to ensure whether the response can be shared with requesting code from the given origin
• Cross-Origin-Embedder-Policy – helps to prevent a document from loading any cross-origin resources that don’t explicitly grant the document permission
• Permissions-Policy – helps to allow and deny the use of browser features in its own frame, and in content within any iframe elements in the document
• Cross-Origin-Opener-Policy – helps to protect websites against a set of cross-origin attacks dubbed XS-Leaks
• Cross-Origin-Resource-Policy – helps to protect websites against speculative side-channel attacks, like Spectre, as well as Cross-Site Script Inclusion attacks
• X-Permitted-Cross-Domain-Policies – helps to control how cross-domain requests from Flash and PDF documents are handled