Security Headers & Caching is a comprehensive WordPress plugin that helps protect your website by implementing essential HTTP security headers and optimizing performance through intelligent caching mechanisms. Compatible with all hosting providers including Aruba, SiteGround, Bluehost, and more. Key
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 5.9 and PHP 7.2.
SourceWordPress plugins · Oct 22, 2026
01 / Source details
Aboutthistool.
Security Headers & Caching is a comprehensive WordPress plugin that helps protect your website by implementing essential HTTP security headers and optimizing performance through intelligent caching mechanisms. Compatible with all hosting providers including Aruba, SiteGround, Bluehost, and more.
Key Features
Easy Configuration – Simple admin interface to enable/disable security headers
Multiple Security Headers – Comprehensive security header support
Smart Caching – Configurable cache duration for better performance
Universal Compatibility – Works with all hosting providers
No Conflicts – Compatible with popular security and caching plugins
Translation Ready – Full internationalization support
Security Headers Included
X-Powered-By – Removes server technology information to prevent targeted attacks
Content-Security-Policy (CSP) – Controls which resources can be loaded to prevent XSS attacks
Strict-Transport-Security (HSTS) – Forces HTTPS connections for enhanced security
X-XSS-Protection – Enables XSS filtering in older browsers
X-Frame-Options – Prevents clickjacking attacks by controlling iframe embedding
X-Content-Type-Options – Prevents MIME type sniffing
Referrer-Policy – Controls how much referrer information is shared
Permissions-Policy – Controls browser features and APIs
For support, feature requests, or bug reports, please visit: * Plugin Website
Credits
Developed by Studio Be4 – Web Design & Development Agency
License
This plugin is licensed under the GPLv2 or later.
See it in action
Screenshots & previews.
Main settings page with all security header optionsEasy-to-use interface with helpful descriptionsCache configuration options
02 / Source details
Gettingstarted.
Automatic Installation
01Log in to your WordPress admin panel
02Navigate to Plugins → Add New
03Search for “Security Headers & Caching”
04Click “Install Now” and then “Activate”
Manual Installation
05Download the plugin ZIP file
06Log in to your WordPress admin panel
07Navigate to Plugins → Add New → Upload Plugin
08Select the downloaded ZIP file and click “Install Now”
09Activate the plugin
Configuration
10After activation, navigate to Security Headers in your WordPress admin menu
11Enable the security headers you want to use
12Configure the Content Security Policy and other settings as needed
13Set cache duration if desired (recommended: 3600 seconds for 1 hour)
14Click “Save Settings”
15Test your configuration at securityheaders.com
03 / Source details
Frequently asked questions.
Will this plugin slow down my website?
No, security headers are lightweight HTTP headers that add negligible overhead. The caching feature actually improves performance.
Is this compatible with my hosting provider?
Yes! This plugin is designed to work with all hosting providers including Aruba, SiteGround, Bluehost, WP Engine, and others. Unlike the previous version, it uses WordPress core hooks that work universally.
Can I use this with other security plugins?
Yes, Security Headers & Caching is designed to work alongside other security plugins. It focuses specifically on HTTP headers.
Will this break my site?
The default settings are conservative and should work for most sites. However, strict Content Security Policy settings can affect sites using inline scripts or external resources. Test thoroughly after configuring.
What is HSTS and should I enable it?
HSTS (HTTP Strict Transport Security) forces browsers to use HTTPS. Only enable this if your site has a valid SSL certificate and is fully accessible via HTTPS.
How do I know if it’s working?
Visit securityheaders.com , enter your website URL, and check your security grade. You should see improvements after activating the plugin.
Can I customize the headers?
Yes! Developers can use the shc_security_headers filter to modify headers programmatically. See the plugin documentation for examples.
What happens to my settings if I deactivate the plugin?
Your settings are preserved in the database. If you uninstall (delete) the plugin, all settings are automatically removed.
Does this plugin work with WordPress multisite?
Yes, the plugin is fully compatible with WordPress multisite installations.
I’m getting a lower score on securityheaders.com, why?
Security headers need to be configured based on your site’s specific needs. A strict CSP policy may require listing all external resources. Adjust settings based on your requirements.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
