HTTP Headers

What It Does

HTTP Headers injects CORS and security-related HTTP response headers into every request served by your WordPress site, letting you control cross-origin access and harden browser-side defences without editing .htaccess or server config files. It provides a settings panel where you toggle common headers like Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, and Access-Control-Allow-Origin. In practice, it is a quick way to satisfy auditor checklists or allow a frontend SPA hosted on another domain to call your WP REST API.

Who It's For

This plugin fits developers and site owners who need to expose the WordPress REST API or media files to another origin (such as a separate frontend, mobile app, or third-party widget) and who also want to ship baseline security headers without touching server config. It is particularly useful for small teams at regulated or security-conscious organizations that need a policy in place fast but do not have a DevOps pipeline to manage headers at the edge or reverse proxy.

Who Should Skip It

If you already manage headers at the CDN, reverse proxy, or web server level, this plugin adds nothing and may even conflict with your existing configuration. Sites running on managed hosts that set headers globally, or anyone comfortable editing nginx/apache config, should skip it to avoid one more moving part.

The Bottom Line

HTTP Headers is a competent, actively maintained plugin that solves a real and common problem: getting CORS and security headers onto a WordPress site without server access. Its weakest signal is the unresolved support threads, so test your configuration carefully and verify headers with a tool like securityheaders.com before relying on it in production. Worth installing for most sites that need it; not worth installing if your hosting stack already handles this.

Related Plugins