Skip to content
Plugin PantryPlugins

Plugins / Pantry Headers

The response headers every site should send, set from one screen with sensible defaults and a button that fetches your own home page and shows what actually arrived. Strict transport security, frame options, content type sniffing, referrer policy and permissions policy.

The Pantry Headers settings screen in the WordPress admin, at Plugin Pantry > Headers.

What it does

  • Strict-Transport-Security with max-age, include subdomains and preload, offered only when the site runs on https
  • X-Frame-Options or a frame-ancestors directive, your choice
  • X-Content-Type-Options nosniff
  • Referrer-Policy from the standard list
  • Permissions-Policy for camera, microphone, geolocation, payment and a few others, each off by default
  • Headers sent on front-end, admin and REST responses, and skipped when the server already sends the same header
  • A test button that requests your home page from the server and lists the security headers that came back

What it does not do

  • No full Content-Security-Policy builder in the free plugin
  • No .htaccess or server configuration writing
  • No removal or rewriting of headers other plugins send
  • No HSTS preload list submission

Measured footprint

Zip size
20 KB
Lines of PHP
1,404
Options
pantry_headers_settings
Post meta
none
Custom tables
none
Post types
none
Cron events
none
Transients
pantry_headers_test_result
Admin assets
includes/core/assets/pantry-admin.css on the settings screen only, includes/core/assets/pantry-admin.js on the settings screen only
Front-end assets
none
External requests
one request to the site's own home page when the Test button is pressed
Measured on
2026-09-12

Compatibility

WordPress
6.4 or newer, tested to 7.1
PHP
8.1 or newer
Where it lives
Plugin Pantry > Headers
Licence
GPLv2 or later

Documentation

Read the documentation

Every setting on the Pantry Headers screen and what each one does, with the hooks it publishes: the same text that ships in the plugin README.

Pro add-on (planned)

See Pantry Pro pricing
  • Content-Security-Policy builder with report collection and a report viewer
  • Per-path header overrides

None of this is in the free plugin, and none of it is switched off inside it. Pro would be a separate plugin.

Changelog

All notable changes to Pantry Headers are documented in this file, in the Keep a Changelog format.

1.0.0 - 2026-09-12

  • First release.
  • Strict-Transport-Security with max age, include subdomains and preload, offered only when the site is served over https.
  • Clickjacking protection: X-Frame-Options (SAMEORIGIN or DENY) or a Content-Security-Policy frame-ancestors directive ('self' or 'none').
  • X-Content-Type-Options: nosniff, on by default.
  • Referrer-Policy, chosen from the standard list of values.
  • Permissions-Policy switches for camera, microphone, geolocation, payment, USB, MIDI, magnetometer and gyroscope, each off by default.
  • Headers are sent on the front end, in wp-admin and on REST responses, and a header the server already sent is never duplicated.
  • A "Test now" button that fetches the site's own home page and lists the security headers that came back, marking each as sent by this plugin or sent by the server.