Portable security hardening for WordPress sites: HTTPS enforcement, security headers (HSTS, CSP, X-Content-Type-Options and friends), DNS health checks (SPF/DKIM/DMARC) and a self-verifying status panel. Works on shared cPanel hosting (Apache/LiteSpeed) and on VPS (nginx, with PHP fallback and a generated config snippet).

Download v1.1.1

Features

• HTTPS and canonical redirect — one 301 from any http:// or non-canonical host straight to https://canonical-host/...; off by default, confirm the canonical host in Settings first.
• Security headers — HSTS (1 year + includeSubDomains, preload opt-in), a safe baseline CSP (editable, report-only toggle), X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, delivered via a managed .htaccess block so cached pages and static files are covered too, with a PHP fallback elsewhere.
• DNS health — read-only SPF / DKIM (incl. key length) / DMARC checks with copy-paste TXT records; detects Resend as the mail sender.
• Status panel — live self-checks (redirect hops, header values, DNS), one pass/fail row per scanner issue; a weekly cron re-check emails the admin on regressions.
• Safety — every .htaccess write makes a timestamped backup (last 10 kept), writes inside # BEGIN/END WS-Security markers, runs a loopback self-test and rolls back automatically if the site returns 5xx.
• Dev environments — all enforcement is suspended on local/development environments (rules stay previewable; override with the ws_security_is_dev filter).

Requirements

• WordPress 5.9+
• PHP 7.4+
• Tested up to WordPress 6.8

Install

1. Download the zip above.
2. In WordPress go to Plugins, Add New, Upload Plugin, and upload it.
3. Activate WS Security from the Plugins screen.

Updates are self-hosted: the plugin reads its Update URI header and checks https://websqu.ad/updates/ws-security.json. New versions show up in the standard WordPress updates screen.

WP-CLI

• wp ws-security status — run all self-checks.
• wp ws-security preview — print the .htaccess block that would be written.
• wp ws-security apply — write the block (backup + self-test + rollback).
• wp ws-security remove — remove the managed block.
• wp ws-security rollback — restore the newest backup.

websquad — brandsquad OÜ, Estonia. Support: [email protected]

WP Plugins · Homepage