---
title: "MS Security Headers"
description: "A plugin that adds the HTTP security headers from Dries Buytaert's checklist without server access. Safe defaults, with a settings page to adjust them."
url: "https://stg-3a6ivm.elementor.cloud/plugins/ms-security-headers/"
canonical: "https://stg-3a6ivm.elementor.cloud/plugins/ms-security-headers/"
post_type: "ms_plugin"
author: "Miriam Schwab"
date_published: "2026-07-07T11:38:37+00:00"
date_modified: "2026-09-14T05:48:24+00:00"
extractor: "block"
---

Dries Buytaert's HTTP Headers Analyzer lists the HTTP security headers a site should be sending. Checking a site against that list usually means a server config change, and on Elementor Hosting I don't have server-level access, so I built a plugin instead.

It adds the headers that matter without touching a server file: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-Permitted-Cross-Domain-Policies, and an optional Strict-Transport-Security upgrade. Everything ships with safe defaults, plus a settings page for the cases where a default needs adjusting.

This plugin increased by score from 4 to 6, which is the highest I can go under the circumstances. I was happy with the increase. I wrote up what I added, what I skipped, and why.