Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vuln...
Free
3M+ installs 4.9★ (8,862)
GD Security Headers
Configure various security-related HTTP headers, including CSP, XSS, Referrer Policy and more.
The facts
- Rating
- 4★ from 8
- Active installs
- 1k+
- Price
- Free
- Last updated
- 12 May 2026
- Added
- Mar 2019
- Requires WP
- 5.5
- Tested up to
- WP 7.0.4
- Requires PHP
- 7.4
- Downloads
- 34,698
Our analysis
AI-assistedGD Security Headers is a WordPress plugin that allows you to configure various security-related HTTP headers to enhance your site's security. It supports headers such as Content Security Policy, XSS Protection, and Referrer Policy, among others, and can log reports from browsers for CSP and XSS. The plugin also provides methods for adding headers to different server types, including Apache and Nginx.
This plugin is suitable for website owners looking to improve their site's security through proper HTTP header configuration. It is particularly useful for those who want to implement advanced security measures without extensive technical knowledge.
Best for: Website owners seeking to enhance security through HTTP header configuration.
What it does well
- ✓Supports multiple security-related HTTP headers
- ✓Includes reporting features for CSP and XSS
- ✓Can generate headers for various server types
- ✓Offers automatic CSP rule filling for popular services
- ✓Allows configuration of Permissions Policy rules
Where it falls short
- •Limited information on user experience and support
- •No mention of compatibility with specific themes or plugins
Verdict
GD Security Headers provides a straightforward way to implement security headers, making it a practical choice for those focused on site security.
From the developer
Milan Petrovic's own description of GD Security Headers, lightly tidied.
Configure various security-related HTTP headers, including Content Security Policy, Feature Policy, Referrer Policy and more. For CSP and XSS plugin supports report logging with 2 additional database tables to store reports from browsers.
Supported security headers
The plugin has support for the following HTTP headers:
- Content Security Policy (CSP) – with reporting
- XSS Protection (XXP) – with reporting
- Feature Policy (Permissions Policy)
- Content Type – No Sniff Policy
- Strict Transport Security
- Referrer Policy
- Frame Options
For CSP, the plugin allows you to set rules for all currently supported directives, additional settings including setting the policy in Report or Live mode. The plugin also includes special extensions that can automatically fill CSP rules for popular Google services you might be using on your website (Fonts, Maps, Adsense, Analytics, TagManager and more) and other popular services (Gravatar, Instagram, PayPal Vimeo and more).
And, for Feature Policy (or Permissions Policy), the plugin allows you to set rules for all currently supported rules (over 25 rules, supported by different browsers).
FLoC / Browsing Topics
Permissions Policy rules list includes ‘browsing-topics’ rule that can be used to disable Google’s new tracking method ‘Browsing Topics API’ (which replaced ‘Federated Learning of Cohorts’ or ‘FLoC’).
Methods for adding headers
The plugin can add all the generated headers into HTACCESS file (for Apache web servers), and they will be applied to all files, not just WordPress generated content. If your website is not using Apache (or .HTACCESS), all rules are generated with each page request and will work with any server type.
And, if you don’t use Apache web server, the plugin has a panel where it displays generated headers for most popular servers: Apache, Nginx and IIS, and you can copy generated headers to add to server configuration files.
About the plugin
- More information about GD Security Headers
- Support and Knowledge Base for GD Security Headers
Tagged as
purpose
Security & Malware Protection
quality
Security
Alternatives
Other plugins for securing a site.
Firewall, Malware Scanner, Two Factor Auth, and Comprehensive Security Features, powered by our 24-hour team....
Free
5M+ installs 4.7★ (4,983)
The best anti-spam protection to block spam comments and spam in a contact form. The most trusted antispam sol...
Free
5M+ installs 4.7★ (1,186)
Loginizer
93Loginizer is a WordPress security plugin which helps you fight against bruteforce attacks.
Free
1M+ installs 4.8★ (1,030)
Safe SVG
93Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
Free
1M+ installs 4.9★ (79)
Protect your website investment with All-In-One Security (AIOS) – a comprehensive and easy to use security plu...
Free
1M+ installs 4.7★ (1,715)