Send the security headers your site is missing.
Kareva Security Headers sets HSTS, Content Security Policy, X-Frame-Options and every other modern security header from your WordPress dashboard. Choose a preset, check the result with the built-in scanner, and tighten your policy from real reports. No server access or code needed.
Free download with every header included, version 1.1.0: install it from Plugins → Add New → Upload Plugin. Pro from $39 a year, with a 7-day money-back guarantee.
Free on WordPress.org with every header included. Pro from $39 a year, with a 7-day money-back guarantee. Made by Kareva Techsol.
Every header is in the free version. Pro from $39 a year, with a 7-day money-back guarantee. Made by Kareva Techsol.
X-Powered-By: PHP/8.3 tells attackers what your server runs.
Try it: apply a preset and see what your pages would send.
- One-click presets
- Content Security Policy editor
- Built-in scanner and grade
- Apache, Nginx, LiteSpeed and IIS
- No tracking, no ads
Protected in three steps
Nothing is sent until you choose a preset, so you stay in control from the first click.
Choose a preset
Basic, Recommended, Strict or WooCommerce-safe. Recommended suits most sites and blocks nothing while you review.
Scan your pages
The scanner shows the headers your pages really send, spots duplicates and leaks, and gives you a grade.
Tighten from reports
Browsers report what your Content Security Policy would block. Allow what you trust in one click, then switch to enforce.
Every header, one dashboard
Headers tell browsers how to treat your site. The right ones stop whole classes of attacks before they reach your visitors.
What it protects against
- ClickjackingX-Frame-Options and frame-ancestors stop other sites from hiding your pages inside theirs.
- Cross-site scriptingA Content Security Policy limits which scripts can run, with per-request nonces for inline code.
- Downgrade and snoopingHSTS keeps browsers on HTTPS, with duration, subdomain and preload options.
- Data and version leaksReferrer-Policy, Permissions-Policy and cross-origin headers, plus removal of X-Powered-By, the generator tag and X-Pingback.
What you get
- Content Security Policy editorReport-only mode, source validation and nonces, with a report collector and a one-click "Allow source" action.
- Scanner with a gradeChecks the headers your pages actually send, from F to A+, and flags headers sent twice.
- Server snippetsReady-made Apache, Nginx, LiteSpeed and IIS configuration, plus optional .htaccess writing for static files.
- Tools for real sitesUp to 20 custom headers, path exclusions, import and export, multisite support and WP-CLI commands.
Built so it can't break your site
Security headers can block things you need. Every change here can be tested and undone.
- Report-only firstThe Recommended preset runs your Content Security Policy in report-only mode, so nothing is blocked while you review.
- Snapshots before every changeYour settings are saved automatically, and you can restore any snapshot with one click.
- Never on the dashboardThe policy isn't sent to the WordPress dashboard or login page, so you can't lock yourself out of settings.
And if anything ever goes wrong, one line in wp-config.php turns every header off, including any written to .htaccess:
// Emergency switch define( 'KAREVA_SH_DISABLE', true );
Free or Pro
Every header and tool above is free and stays free. Pro adds tools for building and monitoring a strict policy.
| Feature | Free | Pro |
|---|---|---|
| All security headers, presets and custom headers | Included | Included |
| Content Security Policy editor and violation reports | Included | Included |
| Scanner, server snippets, snapshots, WP-CLI | Included | Included |
| CSP learning mode | Not included | Collects reports for a few days, then proposes a complete policy for you to review and apply |
| Page rules | Not included | A different policy, or report-only mode, on chosen paths such as /checkout |
| Source packs | Add sources by hand | Allow Google Analytics, Tag Manager, Stripe, Razorpay, PayPal, YouTube, Vimeo, reCAPTCHA, Google Fonts and Gravatar with one tick |
| Scheduled monitoring | Scan when you choose | Daily or weekly scans of key pages, with an email when a grade drops or a header disappears |
| Report tools | Up to 5,000 reports | Room for 50,000 reports, CSV export, grouped summary and a browser-extension noise filter |
Pro pricing
One licence per website. Prices in US dollars.
Personal
1 site. For your own website.
$39
per year
- All Pro features
- Updates and support
Business
5 sites. For freelancers and small studios.
$79
per year
- All Pro features
- Updates and support
Agency
20 sites. For agencies with many clients.
$149
per year
- All Pro features
- Updates and support
Not ready for Pro?The free version includes every security header, all presets, the Content Security Policy editor, violation reports, the scanner and server snippets. Upgrade later without losing your settings.
Download free7-day money-back guarantee. If Pro isn't right for you, ask for a full refund within 7 days of buying. Secure checkout by Freemius, which handles sales tax and VAT.
Questions
Will this break my site?
The Basic and Recommended presets use low-risk headers, and Recommended runs the Content Security Policy in report-only mode, so nothing is blocked. Review the Reports tab before switching to enforce mode. Every change is saved as a snapshot you can restore.
Is the free version enough?
For most sites, yes. Every header, the presets, the CSP editor, violation reports, the scanner and the server snippets are free. Pro helps when you want a strict policy without the manual work: learning mode builds it for you, page rules handle checkout pages, and monitoring warns you if something changes.
My headers don't appear. Why?
A page cache plugin or CDN may still be serving old pages, so clear the cache after saving. Some hosts strip or override headers; in that case, use the server configuration snippets on the Tools tab.
Does it work with Nginx?
Yes. Headers sent from WordPress work on any server. For static files such as images and CSS, copy the Nginx snippet from the Tools tab into your server block.
Should I enable HSTS preload?
Only if every subdomain will support HTTPS permanently. Browsers ship the preload list, so removal takes months.
What if I lock myself out?
Add define( 'KAREVA_SH_DISABLE', true ); to wp-config.php, fix the setting, then remove the line. You can also restore a snapshot on the Tools tab.
Does it collect personal data?
Violation reports store the page address without its query string, the blocked resource and the rule involved. IP addresses and browser details aren't stored, and reports are deleted after 30 days by default.
What counts as a site, and what happens when a yearly licence ends?
Each WordPress website where Pro is active uses one licence. Renew to keep Pro features and updates; the free features keep working either way.
Give your site the headers it should already have
Start with a preset in minutes, and add Pro when you're ready for a strict, monitored policy.
Let’s build something
people love.
Tell us about your business and your goals. We’ll come back with ideas, a clear plan and honest advice on the right way to build it.