Pass the scan on the first try
Ship X-Content-Type-Options, frame controls, Referrer-Policy, HSTS, and Permissions-Policy without a sysadmin ticket. Then prove it on SecurityHeaders.com or Mozilla Observatory.
One plugin. Security headers scanners actually grade.
Wish your site was more secure?
Take the stress out of making your site more secure with just a few clicks.Free gets you the safe defaults.Pro unlocks CSP, monitoring, and a score you can defend.
Why it pays for itself
Headers are not a vanity grade. They are the cheapest way to cut whole classes of browser attacks — and the first thing a client, auditor, or pentest writes up when they are missing.
Stop XSS-shaped mistakes
MIME sniffing, clickjacking, and leaky referrers are default WordPress gaps. Turning them off is one toggle, not a weekend in .htaccess.
CSP without breaking the theme
Build the policy in report-only, watch real violations, then enforce. Nonces stamp WordPress scripts so you are not stuck with unsafe-inline forever.
Three steps. Then you are done.
1. Install
Upload the zip. It works without writing Apache or Nginx config. Free headers start on activation.
2. Scan
The in-plugin scanner and an external check like SecurityHeaders.com should agree. Aim for 100% / A+.
3. Paste your key
Buy Pro here, copy the license key, paste it in Header Genie → License. CSP, COOP/COEP, and monitoring unlock.
What Pro is actually for
Free is the floor. Pro is how you keep the grade as the site grows — embeds, fonts, and the next plugin you install.
CSP builder with host chips
Allow Google Fonts, jsDelivr, YouTube, or your CDN without guessing syntax. Report-only first so you see breakage before visitors do.
Isolation headers
COOP, COEP (credentialless by default so embeds still work), and CORP. The same family of controls that raise Observatory scores.
Monitoring
Usage events, activations, and CSP reports in one screen. When a new plugin blows a directive, you see it.
Compatibility checks
Recommendations tied to what your site actually loads — not a generic checklist you have to translate.
Grade it yourself
Header Genie does not replace these tools. It is how you pass them on WordPress, including hosts that ignore .htaccess.
Pro, one site, one year
£0
Scanner and safe defaults. No license required. Stay here if you only need the basics.
£49/year
CSP, monitoring, isolation headers, and a key for one WordPress site. Auto-renews unless you cancel at least 30 days before the renewal date.
Cards are taken by Stripe, not this site. Manage or cancel in the Stripe customer portal after you log in.