Optional security headers
Use the plugin settings to apply supported response headers when they are compatible with the site.
SECURITY HEADERS · WordPress Plugin 2.0.0
Security headers
Security-header guidance for Omega Security Engine Pro WordPress Plugin 2.0.0, including HSTS, CSP and HTTPS redirect precautions.
Security-header controls in Omega Security Engine Pro
The WordPress security plugin can apply optional security headers as part of its layered hardening controls. High-impact headers are intentionally not forced by default.
HSTS is opt-in
Enable HTTP Strict Transport Security only when HTTPS is permanent and all required subdomain behavior has been considered.
CSP is opt-in
Content-Security-Policy can block legitimate scripts, styles, frames, images and network connections if the policy does not match the site.
HTTPS redirect option
Use only when the WordPress/server environment is correctly configured for HTTPS and proxy handling.
Before enabling HSTS or CSP
- Test on staging or a reversible production window.
- Confirm HTTPS is permanent before HSTS.
- Inventory every required script, style, image, frame and connection origin before CSP.
- Test login, wp-admin, forms, checkout, embeds, analytics, editors and third-party integrations.
- Review reverse-proxy/CDN behavior so redirects and client-IP handling are correct.
Recovery
If a header breaks required functionality, disable or revise the corresponding control and clear any server/CDN caches. HSTS can persist in browsers, which is why it must be enabled cautiously.
Product page and commercial specification
Review the complete public-facing capability specification, pricing and licence information for Omega Security Engine Pro.