Pantry Headers

The response headers every site should send, set from one screen with sensible defaults, and a button that fetches your own home page and shows what actually arrived.

Settings screen: Plugin Pantry > Headers.

What it does

• Strict Transport Security (HSTS) — sends Strict-Transport-Security with the max age you set, and optionally includeSubDomains and preload. Only available when the site is served over https; on a plain http site the switch is shown disabled with the reason, because a browser must never be told to force https on a site that cannot serve it.
• Clickjacking protection — one choice: X-Frame-Options: SAMEORIGIN, X-Frame-Options: DENY, Content-Security-Policy: frame-ancestors 'self', Content-Security-Policy: frame-ancestors 'none', or off.
• Content type sniffing — X-Content-Type-Options: nosniff, on by default.
• Referrer policy — Referrer-Policy set to any of the values in the W3C Referrer Policy specification, or off.
• Permissions policy — one switch per feature (camera, microphone, geolocation, payment, USB, MIDI, magnetometer, gyroscope), each off by default. Turning one on blocks that browser feature for every origin, including this site, by adding it to the Permissions-Policy header. Leaving all of them off sends no Permissions-Policy header at all.
• Sent everywhere — headers are sent on front-end responses (on send_headers), in wp-admin (on admin_init, guarded against headers already sent), on the login screen (on login_init, after WordPress has sent its own X-Frame-Options there), and on REST API responses (on rest_pre_serve_request). Before sending any header, the plugin checks headers_list() and skips a header name the server, your hosting platform, or another plugin already sent, so nothing is ever duplicated and a header set closer to the server always wins.
• Test now — a button on the settings screen that has the server fetch its own home page (wp_remote_get() against home_url( '/' )) and lists the security-relevant headers that came back, marking each as "sent by this plugin" or "sent by the server".

What it does not do

• No full Content-Security-Policy builder in the free plugin.
• No .htaccess or server configuration writing.
• No removal or rewriting of headers other plugins send.
• No HSTS preload list submission — the preload directive is added to the header if you switch it on, but submitting the site to a browser's preload list is a separate step you take yourself.

Data

One option, pantry_headers_settings, holding every switch and value as a single array. One transient, pantry_headers_test_result, holding the result of the last test for one minute. No tables, no custom post types, no cron events, no post meta. Uninstalling the plugin deletes the option and the transient.

External requests

Pressing "Test now" makes one request from the server to its own home page. Nothing else in this plugin makes an external or internal HTTP request, and no request happens on a page load.

Requirements

• WordPress 6.4 or newer
• PHP 8.1 or newer