XeroWP
Beplus Security Headers & Script Auditor
Beplus Security Headers & Script Auditor

Beplus Security Headers & Script Auditor

0/5 (0 ratings) — active installs Updated Sep 13, 2026
content security policycspheadershttp-headerssecurity
Download v1.0.1 Plugin Website
The Headers tab, where each security header can be toggled and configured.

The Headers tab, where each security header can be toggled and configured.

Beplus Security Headers & Script Auditor gives WordPress site owners three things in one screen:

  1. Security header toggles — enable X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security, Permissions-Policy, Content-Security-Policy (with an optional report-only mode), and the legacy X-XSS-Protection header, each with sensible defaults.
  2. A scanner — fetches your homepage, or optionally your whole site (up to 200 of your most recently published posts/pages), and lists every external script, stylesheet, image, iframe, and form target it finds, plus a count of inline scripts/styles.
  3. Recommendations you control — every finding is listed as a checkbox row; uncheck anything you don’t want, and the Content-Security-Policy preview updates live. Apply the checked rows to the CSP field with one click, review it, then press Save. Nothing is ever sent automatically.

There’s also a repeatable table for adding any other custom response header your site needs.

Why use this plugin

  • No external service calls, tracking, or phone-home behaviour — the scan only requests pages on your own site.
  • Every setting is sanitized on save, and header values are stripped of line breaks to prevent HTTP header injection.
  • Sensible, conservative defaults: only X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are enabled out of the box. HSTS, Permissions-Policy, CSP, and X-XSS-Protection are opt-in since they can affect how your site behaves and should be reviewed first.