User Documentation - Version 7.4
WordPress Plugin for Security Headers and Caching Management
Security Headers & Caching is a professional WordPress plugin developed by Studio Be4 to improve your website's security and performance through the implementation of HTTP Security Headers and intelligent cache management.
Security Headers are HTTP headers that the server sends to the browser to communicate how to handle the site's content. They help protect against common attacks such as Cross-Site Scripting (XSS), Clickjacking, and Code Injection.
security-headers-caching folder to /wp-content/plugins/After activating the plugin, follow these steps to configure it:
For most websites, we recommend enabling all security headers with the default settings. These settings offer a good balance between security and compatibility.
| Option | Description | Default Value |
|---|---|---|
| Enable Security Headers | Master switch to enable/disable all headers | Enabled |
| Enable HSTS | Enable Strict-Transport-Security | Enabled |
| Enable XSS Protection | Enable X-XSS-Protection | Enabled |
| Enable X-Frame-Options | Prevents clickjacking | Enabled |
| Enable X-Content-Type-Options | Prevents MIME sniffing | Enabled |
| Content Security Policy | Custom CSP policy | upgrade-insecure-requests |
| Referrer Policy | Control referrer information | strict-origin-when-cross-origin |
| Permissions Policy | Control browser permissions | geolocation=self |
| Cache Duration | Cache duration in seconds | 0 (disabled) |
Automatically removes the X-Powered-By header which reveals information about the server and technology being used.
This prevents targeted attacks based on known vulnerabilities of specific software versions.
Controls which resources can be loaded on your site. Prevents XSS (Cross-Site Scripting) attacks by limiting the execution of unauthorized scripts.
default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google-analytics.com; style-src 'self' 'unsafe-inline'
Forces browsers to use only HTTPS connections. Protects against man-in-the-middle attacks and protocol downgrade.
Enables the XSS filter built into older browsers. Although deprecated in modern browsers in favor of CSP, it still provides additional protection for legacy browsers.
Prevents clickjacking by preventing your site from being embedded in iframes on other domains.
The plugin automatically sets this header to SAMEORIGIN.
Prevents MIME sniffing by preventing browsers from interpreting files differently from the declared MIME type. Protects against attacks based on malicious file uploads.
Controls how much referrer information is shared when users navigate from your site to other sites.
Available options:
no-referrer - Never sends referrer informationstrict-origin-when-cross-origin - (Recommended) Only sends origin for cross-origin requestssame-origin - Sends referrer only for same-domain requestsControls which browser features and APIs can be used on your site. Helps prevent unauthorized use of features like geolocation, microphone, camera, etc.
geolocation=(), microphone=(), camera=() completely blocks access to these features.
The plugin offers granular control over browser cache through Cache-Control headers.
In the Cache Duration field you can specify how long (in seconds) the browser should cache your site's resources.
| Value | Duration | Recommended Use |
|---|---|---|
| 0 | Disabled | Development sites or sites with very dynamic content |
| 3600 | 1 hour | Sites with frequent updates |
| 86400 | 1 day | Sites with relatively static content |
| 604800 | 1 week | Static resources (images, CSS, JS) |
| 2592000 | 1 month | Content that rarely changes |
For most WordPress sites, a cache duration of 3600 seconds (1 hour) or 86400 seconds (1 day) offers a good balance between performance and content updates.
After configuring the plugin, it's important to verify that the security headers are implemented correctly.
Solution:
Solution:
upgrade-insecure-requests'unsafe-inline' if needed for compatibilitySolution:
Solution:
No, security headers are lightweight and add negligible overhead. The caching feature can actually improve site performance.
Yes! The plugin is designed to work with all hosting providers (Aruba, SiteGround, Bluehost, WP Engine, etc.) since it uses native WordPress hooks.
Yes, Security Headers & Caching is designed to work alongside other security plugins. It focuses specifically on HTTP headers.
Security headers will stop being sent, but your settings will be preserved. If you reactivate the plugin, previous settings will be restored.
All plugin settings and data are automatically removed from the database. It leaves no traces in your WordPress installation.
Yes! The plugin provides the shc_security_headers filter that allows developers
to modify headers programmatically.
add_filter( 'shc_security_headers', function( $headers ) {
$headers['X-Custom-Header'] = 'custom-value';
return $headers;
} );
Yes, the plugin is fully compatible with WordPress multisite installations.
To get an A+ score, you need to:
Studio Be4 offers technical support for the Security Headers & Caching plugin:
For a faster response, please prepare the following information: