Jeelsh HTTP Headers

Jeelsh HTTP Headers provides an intuitive interface to configure HTTP response headers directly from your WordPress dashboard, helping you improve your site’s security posture and compliance.

Key Features

• Easily configure Content-Security-Policy (CSP) headers.
• Implement HTTP Strict Transport Security (HSTS).
• Set Referrer-Policy, X-Frame-Options, and Permissions-Policy.
• Add your own custom HTTP headers.

External Services

This plugin does not connect to any third-party service by default. The following items are documented for transparency:

• Vite development server: When the plugin is in development mode (configurable in Config/React.php as ‘develop’), it loads JavaScript modules and HMR WebSocket messages from the configured local Vite server (default http://localhost:3000). No user data is transmitted. This connection is only active when a developer explicitly enables development mode and runs the Vite server locally.

• CSP report-uri: If you configure a report-uri in the CSP settings, the browser will send CSP violation reports to the user-provided URL. The plugin does not provide or operate that endpoint; the site administrator chooses and controls it. By default the report-uri field is empty and no reports are sent.

• Example domains in settings fields: Inputs such as https://example.com and https://api.example.com use IANA-reserved example domains as placeholders only. The plugin does not connect to them.

• GitHub documentation link: The admin sidebar includes a link to https://github.com/jeelsh/http-headers-advanced. It opens only when a user clicks it. GitHub is operated by GitHub, Inc.; for terms and privacy, see https://docs.github.com/en/site-policy/github-terms/github-terms-of-service and https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement.

• Support email link: The admin sidebar includes a mailto:jeelsh@protonmail.com link. It opens the user’s email client; the plugin does not send any data.

• WordPress REST API and admin-ajax: Saving and validating settings uses the site’s own WordPress REST API endpoints and admin-ajax.php. These are same-site, internal communications.

Source Code

The plugin’s user interface is built with React. The compiled, production-ready files are in assets/dist/. The human-readable source code and build tooling are maintained at https://github.com/jeelsh/http-headers-advanced.

To review or rebuild the JavaScript and CSS from source, clone the repository and run:

npm install
npm run build

For end users, the plugin works out of the box with the pre-built assets in assets/dist/.