Jeelsh HTTP Headers

Configure advanced HTTP security headers for your WordPress site through an easy-to-use dashboard interface.

Description

Jeelsh HTTP Headers gives you an intuitive way to manage HTTP response headers directly from your WordPress admin panel. It helps you improve your site's security posture and compliance without editing server configuration files or theme code.

With this plugin you can configure:

• Content-Security-Policy (CSP) headers
• HTTP Strict Transport Security (HSTS)
• Referrer-Policy
• X-Frame-Options
• Permissions-Policy
• X-Content-Type-Options
• X-Permitted-Cross-Domain-Policies
• Your own custom headers

All settings are validated before they are saved and applied.

Features

• Intuitive React-based admin panel
• Predefined security headers with helpful descriptions
• Custom header support
• Settings validation before saving
• Works out of the box with pre-built assets
• No external service dependencies by default

Requirements

• WordPress 5.0 or higher
• PHP 7.4 or higher

Installation

1. Upload the plugin files to /wp-content/plugins/jeelsh-http-headers/, or install the plugin through the WordPress Plugins screen.
2. Activate the plugin through the Plugins screen in WordPress.
3. Open Jeelsh HTTP Headers from the WordPress administration menu to configure your headers.

External Services

This plugin does not connect to any third-party service by default. The following items are documented for transparency:

• CSP report-uri: If you configure a report-uri in the CSP settings, the browser will send CSP violation reports to the user-provided URL. The plugin does not provide or operate that endpoint; the site administrator chooses and controls it. By default the report-uri field is empty and no reports are sent.

• Example domains in settings fields: Inputs such as https://example.com and https://api.example.com use IANA-reserved example domains as placeholders only. The plugin does not connect to them.

• GitHub documentation link: The admin sidebar includes a link to https://github.com/jeelsh/http-headers. It opens only when a user clicks it. GitHub is operated by GitHub, Inc.; for terms and privacy, see GitHub Terms of Service and GitHub Privacy Statement.

• Support email link: The admin sidebar includes a mailto:jeelsh@protonmail.com link. It opens the user's email client; the plugin does not send any data.

• WordPress REST API and admin-ajax: Saving and validating settings uses the site's own WordPress REST API endpoints and admin-ajax.php. These are same-site, internal communications.

Privacy

Jeelsh HTTP Headers does not collect, store, or transmit any personal data on its own. All header configuration is stored in your WordPress database. The only optional external communication is a CSP report-uri that you, the site administrator, choose to configure.

Development

For build and development instructions, see DEVELOPMENT.md.

License

This project is licensed under the GPLv2 or later license. See the license for more details.

Changelog

1.0.2 (2026-08-02)

• Fixed header injection not applying on wp-admin and wp-login.php (headers were only sent on the public front-end via send_headers; now also hooked into admin_init and login_init).
• Added a real check for Apache's mod_headers before allowing the .htaccess injection method; the plugin now falls back to PHP-based injection automatically when .htaccess isn't actually usable.
• Fixed a 404 on the bundled Inter Variable font files caused by Vite emitting absolute root URLs in the compiled CSS; the build now uses a relative base so assets resolve correctly regardless of the WordPress install path.
• Finished the rebrand from "HTTP Headers Advanced" to "Jeelsh HTTP Headers": renamed internal option/prefix/nonce keys and the localized script object, and cleaned up translation files.
• Admin panel visual adjustments: removed the unused dark-mode theme variant, introduced brand color tokens, and switched headings/mono text to the JetBrains Mono typeface.
• Added new UI building blocks (CircleField, NavGlowButton) and removed the now-unused ThemeToggle component.

1.0.1 (2026-07-31)

• Improved the admin panel display.
• Improved plugin documentation.

1.0.0 (2026-07-31)

• First release.