Portable security hardening for WordPress sites: HTTPS enforcement, security headers (HSTS, CSP, X-Content-Type-Options and friends), a Content-Security-Policy builder that reaches an A+ on securityheaders.com and the MDN HTTP Observatory, DNS health checks (SPF/DKIM/DMARC) and a self-verifying status panel. Works on shared cPanel hosting (Apache/LiteSpeed), on VPS (nginx, with PHP fallback and a generated config snippet) and behind a TLS-terminating proxy such as Cloudflare.

Download v2.1.1

Features

• HTTPS and canonical redirect — one 301 from any http:// or non-canonical host straight to https://canonical-host/...; off by default, confirm the canonical host in Settings first.
• Security headers — HSTS (2 years + includeSubDomains, preload opt-in), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, the cross-origin isolation trio and Clear-Site-Data on logout, delivered via a managed .htaccess block so cached pages and static files are covered too, with a PHP fallback elsewhere.
• Content-Security-Policy — its own tab with Basic, Strict, Hardened and Custom presets, a checklist of third-party services (Google Analytics and Ads, Hotjar, Meta pixel, reCAPTCHA, Stripe, Cloudflare, video embeds and more), extra hosts per directive, a separate lax wp-admin/login policy, and a built-in collector for browser violation reports.
• Inline scripts by hash — Strict and Hardened can drop 'unsafe-inline' from script-src: a crawl of the public pages and a runtime recorder store the SHA-256 hash of every inline script and event handler, and the block re-syncs itself. Hashes survive full-page caches where nonces cannot.
• DNS health — read-only SPF / DKIM (incl. key length) / DMARC checks with copy-paste TXT records; detects Resend as the mail sender.
• Status panel — live self-checks (redirect hops, header values, DNS), one pass/fail row per scanner issue; a weekly cron re-check emails the admin on regressions.
• Safety — every .htaccess write makes a timestamped backup (last 10 kept), writes inside # BEGIN/END WS-Security markers, runs a loopback self-test and rolls back automatically if the site returns 5xx.
• Dev environments — all enforcement is suspended on local/development environments (rules stay previewable; override with the ws_security_is_dev filter).

Requirements

• WordPress 5.9+
• PHP 7.4+
• Tested up to WordPress 7.1

Install

1. Download the zip above.
2. In WordPress go to Plugins, Add New, Upload Plugin, and upload it.
3. Activate WS Security from the Plugins screen.

Updates are self-hosted: the plugin reads its Update URI header and checks https://websqu.ad/updates/ws-security.json. New versions show up in the standard WordPress updates screen.

WP-CLI

• wp ws-security status — run all self-checks.
• wp ws-security preview — print the .htaccess block that would be written.
• wp ws-security apply — write the block (backup + self-test + rollback).
• wp ws-security remove — remove the managed block.
• wp ws-security rollback — restore the newest backup.
• wp ws-security hashes --collect — crawl the site and store its inline-script hashes.

websquad — brandsquad OÜ, Estonia. Support: [email protected]

WP Plugins · Homepage