Kareva Security Headers

Kareva Security Headers helps protect your visitors from clickjacking, cross-site scripting, MIME sniffing and data leakage by sending modern HTTP security headers. No server access or code is needed.

Features

• One-click presets: Basic, Recommended, Strict and WooCommerce-safe
• Strict-Transport-Security (HSTS) with duration, subdomain and preload options
• Content Security Policy editor with report-only mode, per-request nonces and source validation
• Built-in CSP violation report collector with a one-click “Allow source” action
• X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy
• Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy
• X-Permitted-Cross-Domain-Policies and X-XSS-Protection
• Remove X-Powered-By, the generator tag, X-Pingback and the REST API discovery link
• Up to 20 custom headers, with protection against unsafe header names
• Scanner that shows the headers your pages actually send, with a local grade
• Apache, Nginx, LiteSpeed and IIS configuration snippets, plus optional .htaccess writing
• Path exclusions with wildcards
• Automatic snapshots before every change and one-click restore
• Import and export, multisite support, WP-CLI commands and developer hooks
• No tracking, no ads, no locked features

Safe by design

Nothing is sent until you choose a preset. The Recommended preset runs the Content Security Policy in report-only mode, so nothing is blocked while you review reports. If a header ever locks you out, add define( 'KAREVA_SH_DISABLE', true ); to wp-config.php.

WP-CLI

• wp kareva-sh status
• wp kareva-sh apply-preset <basic|recommended|strict|woocommerce>
• wp kareva-sh enable / wp kareva-sh disable
• wp kareva-sh export [--file=<path>]
• wp kareva-sh import <file>
• wp kareva-sh scan [<url>]
• wp kareva-sh purge-reports [--older-than=<days>]

For developers

Filters: kareva_sh_headers, kareva_sh_csp_directives, kareva_sh_admin_tabs, kareva_sh_accept_reports, kareva_sh_store_report, kareva_sh_is_excluded, kareva_sh_capability, kareva_sh_report_rate_limit, kareva_sh_report_global_limit, kareva_sh_max_reports, kareva_sh_client_ip, kareva_sh_presets, kareva_sh_csp_in_admin, kareva_sh_known_conflicts.

If your site is behind a proxy or CDN, every visitor shares the proxy’s address for report rate limiting. Use kareva_sh_client_ip to return the real visitor address from a header your proxy sets and that visitors cannot forge.

Actions: kareva_sh_settings_saved, kareva_sh_before_send_headers, kareva_sh_report_received.

Themes can print the current CSP nonce with kareva_sh_get_nonce().

Support

Use the support forum on WordPress.org or email [email protected]. Built by Kareva Techsol.

External services

Freemius (optional opt-in and upgrades). The plugin includes the Freemius SDK. It is used for an optional usage opt-in and for the “Upgrade” page where you can buy the separate Pro version. No feature of this plugin depends on Freemius or on a licence. On first activation you are asked whether to opt in; you can skip, and nothing is sent unless you opt in or start a purchase or trial. If you opt in, Freemius receives your site address, WordPress and PHP versions, plugin version, and your name and email address; it also receives activation, deactivation and uninstall events (with any feedback you choose to give). You can opt out at any time from the plugin’s Account page. Freemius Terms and Privacy Policy.

Apart from Freemius as described above, the plugin contacts no external service on its own.

• The Scanner requests pages on your own site only, when you click “Scan page”.
• The “Check on securityheaders.com” link on the Scanner screen opens securityheaders.com in your browser only when you click it. That site, operated by Snyk, receives the address of the scanned page. Snyk Terms of Use and Privacy Notice.
• If you enter an external report URL on the Content Security Policy screen, your visitors’ browsers send violation reports (blocked resource address, page address and policy rule) to that URL. This is off unless you set it.