From F to A+.
This is the path inside WordPress. Scan what the site sends, turn on the free defaults, then use Pro to build CSP without breaking the front end.
- 01 · Free
Scan, then fix the basics
Open HeaderGenie. Run the scanner. Enable nosniff, frame controls, Referrer-Policy, and HSTS. Scan again.
- 02 · Pro
Build CSP, then prove A+
Activate a key. Start CSP in report-only. Use Compatibility, enforce when reports are quiet, then check the public scanners.
What “A+” means here
We mean an independent grade on tools such as SecurityHeaders.com and Mozilla Observatory. Those tools grade the public site, not wp-admin. HeaderGenie sends the headers from PHP, so the result does not depend on Apache, Nginx, or .htaccess.
Host, theme, plugins, and CDN still matter. We do not guarantee a particular grade. The screenshots in this walkthrough are from a live WordPress admin after HeaderGenie Pro is already enforcing, using the same tabs you get after you install the plugin.