Send Basic Security Headers
Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Allow Application Passwords on Local Sites Without HTTPS
Turns on Application Passwords for local and development copies of the site that run on plain http, so you can test REST API integrations and apps locally the same way as in production.
Block TRACE, TRACK and Other Unusual HTTP Methods
Answers requests that use HTTP methods WordPress never needs (such as TRACE, TRACK, CONNECT or DEBUG) with a 405 error before any page is built.
Enable HTTP Strict Transport Security (HSTS)
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
Find Insecure http:// Links in Content (WP-CLI)
Adds a "wp find-http-links" command that lists posts containing http:// images, scripts or links, marking which point to your own domain, to clean up mixed content after moving to HTTPS.
Force HTTPS on the Front End
Sends visitors who open a page over plain HTTP to the secure HTTPS address with a permanent redirect, once your site URL is set to https.
Last-Modified Header and 304 Responses for Posts
Sends a Last-Modified header with each post's update time and answers repeat visits from crawlers and browsers with "304 Not Modified", saving bandwidth and crawl budget.
Log Slow Outgoing HTTP Requests
Times every request your site makes to other servers (update checks, APIs, license servers) and records the ones slower than a second under Tools > Slow HTTP Calls, so you can find what is holding up page loads.
Preload Header for Your Theme Stylesheet
Sends an HTTP Link preload header for your theme's main stylesheet, so browsers, and CDNs that support Early Hints, start downloading the CSS before the HTML has even arrived.
Redirect All Traffic to HTTPS
Permanently redirects every plain HTTP request to the HTTPS version of the same URL, for sites whose host does not do it already.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.
Send WordPress Email Through the Mailgun API
Delivers all WordPress emails through Mailgun's HTTP API, which avoids blocked SMTP ports and gives you Mailgun's delivery logs and tracking.
Send WordPress Email Through the Postmark API
Delivers all WordPress emails through Postmark's HTTP API instead of PHP mail or SMTP, for fast, reliable delivery on hosts that block outgoing mail ports.
Show Outgoing HTTP Requests in the Admin Bar
Counts the external HTTP requests WordPress, plugins and themes make while building a page, and lists each URL, status and time in an admin bar menu for administrators.
Skip Slow Site Health Tests
Removes the Site Health checks that make HTTP requests back to your own site, which are slow or time out on some hosts.
Upgrade http:// Links to Your Own Site to https://
Rewrites old http:// links and images pointing to your own domain to https:// when content is displayed, fixing "not secure" mixed content warnings after moving to SSL without editing every post.