Title: Beplus Security Headers & Script Auditor Author: rimbeplus Published: Ògún 19, 2026 Last modified: Ògún 19, 2026 --- Ṣàwárí àwọn plugin ![](https://ps.w.org/beplus-security-headers-script-auditor/assets/banner-772x250. png?rev=3654344) ![](https://ps.w.org/beplus-security-headers-script-auditor/assets/icon-256x256. png?rev=3654344) # Beplus Security Headers & Script Auditor Láti ọwọ́ [rimbeplus](https://profiles.wordpress.org/rimbeplus/) [Ṣe ìgbàsílẹ̀](https://downloads.wordpress.org/plugin/beplus-security-headers-script-auditor.1.0.0.zip) * [Àwọn àlàyé](https://yor.wordpress.org/plugins/beplus-security-headers-script-auditor/#description) * [Àwọn àgbéyẹ̀wò](https://yor.wordpress.org/plugins/beplus-security-headers-script-auditor/#reviews) * [Ìgbéwọlẹ̀](https://yor.wordpress.org/plugins/beplus-security-headers-script-auditor/#installation) * [Ìdàgbàsókè](https://yor.wordpress.org/plugins/beplus-security-headers-script-auditor/#developers) [Ìrànlọ́wọ́](https://wordpress.org/support/plugin/beplus-security-headers-script-auditor/) ## Àpèjúwe Beplus Security Headers & Script Auditor gives WordPress site owners three things in one screen: 1. **Security header toggles** — enable X-Frame-Options, X-Content-Type-Options, Referrer- Policy, Strict-Transport-Security, Permissions-Policy, Content-Security-Policy ( with an optional report-only mode), and the legacy X-XSS-Protection header, each with sensible defaults. 2. **A scanner** — fetches your homepage, or optionally your whole site (up to 200 of your most recently published posts/pages), and lists every external script, stylesheet, image, iframe, and form target it finds, plus a count of inline scripts/ styles. 3. **Recommendations you control** — every finding is listed as a checkbox row; uncheck anything you donÌtumọ̀ Yorùbá: ’t want, and the Content-Security-Policy preview updates live. Apply the checked rows to the CSP field with one click, review it, then press Save. Nothing is ever sent automatically. ThereÌtumọ̀ Yorùbá: ’s also a repeatable table for adding any other custom response header your site needs. #### Why use this plugin * No external service calls, tracking, or phone-home behaviour — the scan only requests pages on your own site. * Every setting is sanitized on save, and header values are stripped of line breaks to prevent HTTP header injection. * Sensible, conservative defaults: only X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are enabled out of the box. HSTS, Permissions-Policy, CSP, and X-XSS-Protection are opt-in since they can affect how your site behaves and should be reviewed first. ## Àwọn àwòrán ìbòjú [⌊The Headers tab, where each security header can be toggled and configured.⌉⌊The Headers tab, where each security header can be toggled and configured.⌉[ The Headers tab, where each security header can be toggled and configured. [⌊The Scanner tab, showing detected external resources as a checklist and a live Content-Security-Policy preview.⌉⌊The Scanner tab, showing detected external resources as a checklist and a live Content-Security-Policy preview.⌉[ The Scanner tab, showing detected external resources as a checklist and a live Content- Security-Policy preview. ## Ìgbéwọlẹ̀ 1. Upload the plugin files to the `/wp-content/plugins/beplus-security-headers-script- auditor` directory, or install the plugin through the WordPress plugins screen directly. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. Go to the “Security Headers” menu item (in the main admin sidebar) to review the default header configuration. 4. Open the Scanner tab and click “Run Scan” (optionally ticking “Scan entire site” first) to see what external resources your site loads, uncheck anything you donÌtumọ̀ Yorùbá: ’t want, then apply the checked rows to the Content-Security-Policy field. 5. Click “Save Changes” to apply your configuration. ## FAQ ### Will this break my site if I enable everything at once? It can, especially Content-Security-Policy. Start with the scanner recommendations, use “Report-only mode” for CSP first to observe without blocking anything, and only switch to enforcing mode once youÌtumọ̀ Yorùbá: ’ve confirmed the policy covers everything your site actually loads. ### Does the scanner send my data anywhere? No. It performs normal HTTP requests from your own server to pages on your own site, using the built-in WordPress HTTP API. Nothing is sent to any third party. ### Does this replace a full security audit? No. Even the whole-site option only scans your homepage plus your most recently published posts/pages (capped at 200) and is meant as a starting point for building a Content-Security-Policy, not a substitute for a complete security review of your site. ## Àwọn àgbéyẹ̀wò Kò sí àwọn àgbéyẹ̀wò fún plugin yìí. ## Àwọn Olùkópa & Olùgbéejáde “Beplus Security Headers & Script Auditor” jẹ́ ètò ìṣàmúlò orísun ṣíṣí sílẹ̀. Àwọn ènìyàn wọ̀nyí ti ṣe ìkópa sí plugin yìí. Àwọn Olùkópa * [ rimbeplus ](https://profiles.wordpress.org/rimbeplus/) [Túmọ̀ “Beplus Security Headers & Script Auditor” sí èdè rẹ.](https://translate.wordpress.org/projects/wp-plugins/beplus-security-headers-script-auditor) ### Ṣe o nífẹ̀ẹ́ sí ìdàgbàsókè? [Ṣàwárí koodu](https://plugins.trac.wordpress.org/browser/beplus-security-headers-script-auditor/), ṣàyẹ̀wò [ibi ìpamọ́ SVN](https://plugins.svn.wordpress.org/beplus-security-headers-script-auditor/), tàbí ṣe àgbékalẹ̀ sí [àkọsílẹ̀ ìdàgbàsókè](https://plugins.trac.wordpress.org/log/beplus-security-headers-script-auditor/) nípasẹ̀ [RSS](https://plugins.trac.wordpress.org/log/beplus-security-headers-script-auditor/?limit=100&mode=stop_on_copy&format=rss). ## Àkọsílẹ̀ àwọn àyípadà #### 1.0.0 * Initial release: security header toggles, homepage/whole-site scanner with a pick-and-choose CSP checklist, and custom header repeater. ## Àkójọpọ̀ Meta * Ẹ̀yà **1.0.0** * Ìgbàgbọ́hùn tó kẹ́yìn **ọ̀sẹ̀ 3 sẹ́yìn** * Àwọn ìgbéwọlẹ̀ tó ṣiṣẹ́ **Tó kéré sí 10** * Ẹ̀yà WordPress ** 6.0 tàbí ju bẹ́ẹ̀ lọ ** * Dánwò dé **7.1** * Ẹ̀yà PHP ** 7.4 tàbí ju bẹ́ẹ̀ lọ ** * Èdè * [English (US)](https://wordpress.org/plugins/beplus-security-headers-script-auditor/) * Àwọn àmì * [content security policy](https://yor.wordpress.org/plugins/tags/content-security-policy/) [csp](https://yor.wordpress.org/plugins/tags/csp/)[headers](https://yor.wordpress.org/plugins/tags/headers/) [http-headers](https://yor.wordpress.org/plugins/tags/http-headers/)[security](https://yor.wordpress.org/plugins/tags/security/) * [Ìwòye Tó Péye](https://yor.wordpress.org/plugins/beplus-security-headers-script-auditor/advanced/) ## Àwọn ìbò Kò sí ìwádìí tí a tíì fi ránṣẹ́. [Your review](https://wordpress.org/support/plugin/beplus-security-headers-script-auditor/reviews/#new-post) [Wo gbogbo àwọn àgbéyẹ̀wò](https://wordpress.org/support/plugin/beplus-security-headers-script-auditor/reviews/) ## Àwọn Olùkópa * [ rimbeplus ](https://profiles.wordpress.org/rimbeplus/) ## Ìrànlọ́wọ́ Nǹkan wà tí o fẹ́ sọ? Ṣé o nílò ìrànlọ́wọ́? [Wo àpéjọ ìrànlọ́wọ́](https://wordpress.org/support/plugin/beplus-security-headers-script-auditor/)