Abdal Security Headers applies HTTP security headers from one dashboard. The Smart CSP Assistant watches what the site actually loads, then suggests CSP origins for you to review. Nothing is auto-whitelisted.

Smart CSP Assistant:

Hybrid discovery: WordPress-registered assets, CSP Report-Only, a runtime observer, and an optional deep file scan of plugins and themes
Timed learning (15 minutes to 24 hours) or manual stop, with optional continuous monitoring
Optional deep file scan with a cancellable progress bar; learning duration switches to Manual so a timer cannot stop the scan
Merge selected origins into existing CSP fields without replacing current values
Marks findings already present in CSP fields as Added
Dangerous values require explicit confirmation
Blocking CSP is paused during learning so the site keeps working

Also included:

XSS, clickjacking, MIME sniffing, HSTS, Referrer-Policy, and Permissions-Policy, each with its own settings card
Live CSP header preview and a full-size CSP directive editor
WordPress hardening cards for X-Powered-By, version hiding, login errors, XML-RPC method policies, X-Pingback, and REST API access control
Security Profiles for Compatibility, Recommended, Hardened, and Manual that update headers and features without changing CSP
Export and import all plugin settings as a JSON file from the Settings screen
Top-level Security Headers menu with a Security Control Center dashboard, Security Headers, Content Security Policy, Security Features, and Settings, RTL, and mobile layout
Standard WordPress dashboard widget for security status, headers, CSP, and recent activity

Security Headers Managed:

X-Frame-Options
X-XSS-Protection
X-Content-Type-Options
Strict-Transport-Security (HSTS)
Content-Security-Policy (CSP)
Referrer-Policy
Permissions-Policy
Access-Control-Allow-Origin

Languages

This plugin is available in the following languages:
– English (en_US)
– Persian (fa_IR)
– Spanish (es_ES)
– Japanese (ja)
– German (de_DE)
– French (fr_FR)
– Portuguese – Brazil (pt_BR)
– Russian (ru_RU)
– Italian (it_IT)
– Turkish (tr_TR)
– Chinese Simplified (zh_CN)
– Arabic (ar)

License

This plugin is released under the AGPLv3 or later License.
License details: https://www.gnu.org/licenses/agpl-3.0.html