Send Basic Security Headers
Adds common HTTP security headers to front-end responses: nosniff, same-origin framing, a strict referrer policy and a restrictive permissions policy.
WPIDE Team 6 installs
Snippet Library
WordPress code snippets, ready to use
3,040 free snippets from the WPIDE team and the community. Copy the code, or add any snippet to your site in one click with WPIDE.
Add a Reply-To Header to Outgoing Emails
Adds the site admin address as Reply-To on emails that do not set one, so replies to no-reply senders reach a real inbox.
Allow Your Site to Be Embedded Only on Partner Domains
Replaces the usual same-site framing rule with a Content-Security-Policy frame-ancestors list, so your pages can be shown in iframes on the partner sites you name and nowhere else.
Browser and CDN Caching Headers for Visitors
Sends Cache-Control headers on public pages for logged-out visitors, so a CDN or proxy can cache them for a few minutes.
Browser and CDN Caching for Feeds and Sitemaps
Sends cache headers on RSS feeds and XML sitemaps so feed readers, crawlers and CDNs can reuse them for an hour instead of making WordPress rebuild them on every request.
BuddyPress: Unread Notifications Shortcode
Adds a [wpide_bp_notifications] shortcode that shows a bell link with the member's unread BuddyPress notification count, for headers and menus built with blocks.
Content Security Policy Builder With Violation Reports
Sends a report-only Content Security Policy and collects the browser's violation reports, then lists every blocked source per directive under Tools > CSP Reports with a suggested policy you can enforce later.
Content Security Policy Header (Report-Only)
Sends a starter Content Security Policy in report-only mode, so you can see in the browser console what a strict policy would block before enforcing it.
Cross-Origin Opener Policy and Related Isolation Headers
Sends Cross-Origin-Opener-Policy, Origin-Agent-Cluster and X-Permitted-Cross-Domain-Policies headers on public pages, which stop other sites you link to or that open yours from reaching into your pages.
EDD Cart Link With Item Count Shortcode
Adds a [wpide_edd_cart] shortcode that prints a "Cart (2)" link to the Easy Digital Downloads checkout, for headers, menus or widgets.
Enable HTTP Strict Transport Security (HSTS)
Tells browsers to always use HTTPS for your domain for one year. Only enable it once the whole site, including subdomains you use, works over HTTPS.
Full-Screen Search Overlay
Opens a full-screen search box when visitors click any link to #search (for example a menu item) and closes with Escape, giving small headers a roomy, focused search.
Fundraising Totals Shortcode (GiveWP)
Adds a [wpide_give_totals] shortcode that shows the total raised and number of donations across all your GiveWP forms (or selected ones), for headers, impact pages and annual reports.
Hide Bricks Templates From Non-Administrators
Removes the Bricks Templates menu for everyone except administrators, protecting headers, footers and popups built as Bricks templates.
Hide Elementor Templates From Non-Administrators
Removes the Templates menu Elementor adds to wp-admin for everyone except administrators and blocks direct access to the list, protecting headers, footers and popups.
Keep REST API Responses Out of Search Results
Sends an X-Robots-Tag: noindex header with every REST API response so search engines do not index raw JSON from /wp-json/ next to your real pages.
Last-Modified Header and 304 Responses for Posts
Sends a Last-Modified header with each post's update time and answers repeat visits from crawlers and browsers with "304 Not Modified", saving bandwidth and crawl budget.
Let Other Sites Read Your Feeds With JavaScript
Sends a CORS header with your RSS and Atom feeds, so web apps, widgets and dashboards on other domains can load them with fetch() instead of hitting a browser error.
Limit REST API CORS to Your Own Apps
Replaces WordPress's permissive cross-origin (CORS) headers with an allow-list, so only the browser apps you name, such as a headless front end, can call the REST API with credentials.
Move the Admin Bar to the Bottom on the Front End
Pins the admin bar to the bottom of the screen on the front end, so it no longer covers sticky headers and menus while you browse your site.
Nonce-Based Content Security Policy for Scripts
Adds a fresh random nonce to every script WordPress prints and sends a strict, nonce-based script policy (report-only by default), the modern way to block injected scripts.
Preload Header for Your Theme Stylesheet
Sends an HTTP Link preload header for your theme's main stylesheet, so browsers, and CDNs that support Early Hints, start downloading the CSS before the HTML has even arrived.
Reject Requests for Unknown Host Names
Returns an error for requests whose Host header is not your site's domain, which blocks host header injection tricks (such as poisoned password reset links) and junk traffic aimed at your server's IP.
Remove the X-Mailer Header From Emails
Stops outgoing emails announcing "PHPMailer" and its version in the X-Mailer header, which reveals details about your server and can count against you in spam filters.