Pro · one site per licence

Build CSP, then prove A+.

CSP is the header that wins the grade and the one that can break a theme. HeaderGenie starts in report-only, then you enforce when the reports are quiet.

Activate a Pro key

Buy a licence on this site, copy the key, and paste it on the License tab. The key pins to the first WordPress site that activates it. Deactivate there before you move it.

HeaderGenie License tab with a Pro key activated — Paste a key from this site. The key pins to the first WordPress site that activates it.

Report-only first

Pro enables CSP in report-only. Visitors are not blocked. You see which scripts, fonts, and embeds would have failed. Add those hosts in the builder instead of writing the header by hand.

HeaderGenie CSP builder with hosts added from scans — The builder records the hosts your public pages actually use. Start in report-only, then keep these sources when you enforce.

Check compatibility

Compatibility is tied to what the public pages actually load. Use it after a scan so the policy matches the live site, including CDNs and embeds you did not remember.

HeaderGenie Compatibility checks — Compatibility looks at what the site actually loads, so you add sources instead of guessing syntax.

Enforce, then isolate

When reports look right, turn off report-only. Add COOP, COEP, and CORP on the Headers tab if you want the extra isolation scanners look for. Then scan inside the plugin and on the public tools.

HeaderGenie CSP enforcing — When reports are quiet, switch off report-only. That is the header scanners grade for A+.

HeaderGenie isolation headers COOP, COEP and CORP — COOP, COEP, and CORP are Pro headers. They sit on the Headers tab with the rest.

HeaderGenie Monitoring with scan reports — Monitoring keeps the scan history and CSP reports, so you can see the site change over time.

HeaderGenie Scanner after CSP and isolation headers — The in-plugin scanner should now agree with the headers you are sending.

SecurityHeaders.com A+ result for the WordPress site — Prove it independently. SecurityHeaders.com and Mozilla Observatory grade the public site, not wp-admin.

Independent check: SecurityHeaders.com and Mozilla Observatory. Those grades still depend on your host, cache, and CDN as well as HeaderGenie.

Get Pro Download the plugin