Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Headers Security Advanced & HSTS WP · Version history

Headers Security Advanced & HSTS WP changelog and version history

Latest version
5.3.6
Oct 30, 2026 (10 days ago)
Releases
44
since 2022
In the last year
7
about one every 58 days
Tested up to
WordPress 7.0.8
PHP 7.4 or later

Releases each year

  • 20228 releases
  • 202315 releases
  • 202410 releases
  • 20255 releases
  • 20266 releases

20266 releases

  1. Headers Security Advanced & HSTS WP 5.3.6Latest

    • This release fixes a 502 error on logout that could occur on nginx-in-front-of-Apache hosting (Plesk, webgo and similar).
    • Fixed: Logging out of WordPress could return “502 Bad Gateway” from nginx (with “upstream sent too big header” in the server log) when the plugin was active. On logout WordPress already sends a large header block (it expires several cookies at once and adds the redirect), and the plugin’s security…

  2. Headers Security Advanced & HSTS WP 5.3.5

    • This release brings back server-level header coverage (cached pages and static files) that 5.3.4 lost, without reintroducing duplicate headers.
    • Fixed: On full-page caches and static files (CSS, JS, images) the security headers were missing after 5.3.4, because headers were emitted only through PHP and those responses never run PHP. External scanners could report the headers as gone. The plugin now writes the headers to .htaccess again on A…
    • Added: Automatic de-duplication is available but is turned off by default in this version. The plugin writes the header to .htaccess and PHP keeps sending it too. On Apache the .htaccess directive replaces, so you still get a single copy. On LiteSpeed .htaccess appends instead, so if a header shows…
    • Added: A “Run check now” button on the settings page (Delivery diagnostics) shows which web server was detected, whether the .htaccess block is in place, the backend port the plugin learned (or that it has not learned one yet), the exact loopback candidates tried and the responding server, so heade…
    • Added: Per-header delivery control under “Advanced: per-header delivery” (collapsed by default). Each header can be left on “On” (the plugin manages it: it writes the header to .htaccess and PHP sends it), set to “Server only” (keep the server’s or another plugin’s copy and drop the plugin’s own),…
    • Added: On Nginx and IIS the plugin does not write .htaccess (those servers do not read it) and instead shows the exact server-config snippet to hand to your host for server-level caches. Normal pages remain covered via PHP.
    • Safety: Every .htaccess write is verified over HTTP and automatically rolled back to the previous file if the site returns an error, and the block is wrapped so a server without mod_headers simply ignores it. The block uses stable markers so upgrades replace it in place instead of stacking, and it…
    • Changed: Any header you had previously disabled is preserved as “Off” under the new per-header delivery control, so no header you intentionally turned off comes back.
    • Note: Content-Security-Policy continues to be sent via PHP on the front-end only (never written to .htaccess), so a strict or nonce-based policy cannot reach wp-admin or be frozen into a cached file.

  3. Headers Security Advanced & HSTS WP 5.3.4

    • This release fixes duplicate security headers and makes header delivery predictable on every server.
    • Fixed: Duplicate headers (Content-Security-Policy, Referrer-Policy, Cross-Origin-*, X-Permitted-Cross-Domain-Policies, Access-Control-Allow-Methods and others) that appeared on Apache and LiteSpeed when both PHP and .htaccess emitted them.
    • Changed: Headers are now sent a single time via PHP on all servers. The plugin no longer writes a header block to .htaccess, so there is exactly one source and no duplicates. Any block left by previous versions (including very old formats) is automatically removed on update.
    • Fixed: The “disable” checkboxes now work for every header, not just four, and they fully turn a header on or off. The checkboxes have been reset once during the update; a notice explains the change so no site silently loses a header it meant to keep.
    • Fixed: The checkbox previously labelled “CSP” actually controlled Permissions-Policy; it has been renamed. Because its meaning changed, it (and the other reset checkboxes) start unchecked. The update notice explains how to re-check any header you want disabled.
    • Removed: The deprecated X-Content-Security-Policy header (superseded by Content-Security-Policy).
    • Changed: Cross-Origin-Embedder-Policy is no longer sent by default (its previous “unsafe-none” value added no protection and used non-standard syntax).
    • Fixed: Removed invalid report-to=’default’ syntax from Cross-Origin headers.
    • Fixed: Rewrite rules are no longer flushed during plugin updates or settings saves (fixes multilingual routing breakage with Polylang and similar plugins).
    • Changed: The plugin’s Content-Security-Policy is applied to the site front-end; wp-admin is left to WordPress core’s own policy, so a strict CSP cannot break the block editor. All other security headers are still applied everywhere.
    • Note: static files (CSS, JS, images) served directly by the web server no longer receive security headers, since headers are now emitted via PHP only. The practical impact is X-Content-Type-Options on static assets. Server-level coverage will return as an explicit opt-in feature in a future release.

  4. Headers Security Advanced & HSTS WP 5.3.3

    • This update introduces Shield — optional advanced tools for professionals who need deeper security monitoring. Every existing feature remains completely free, forever.
    • New: Shield tab-based interface (Settings, Dashboard, CSP, Notifications, Export/Import, License, Free vs Shield, FAQ)
    • New: Security Advisor with personalized recommendations
    • New: Security Score Dashboard (A+ to F grading, 10 header status overview)
    • New: CSP Guide with recommended tools (Csper.io, Google CSP Evaluator, Report URI, URIports)
    • New: CSP violation analytics (top blocked domains, directives, trends)
    • New: Email alerts when security score drops or headers change
    • New: Webhook notifications (Slack, Discord, Microsoft Teams, custom JSON endpoint)
    • New: Export/Import settings for agencies managing multiple sites
    • New: Weekly automated scans with history tracking
    • New: Comprehensive FAQ with search and category filters
    • New: Free vs Shield comparison with transparent pricing
    • Improved: Clean uninstall (license auto-deactivated, all options removed)

  5. Headers Security Advanced & HSTS WP 5.3.2

  6. Headers Security Advanced & HSTS WP 5.2.5

    • I don’t want to tell you what to do, but here’s the thing: When you update the Headers Security Advanced & HSTS WP plugin, you don’t just click a button, you enter a world of enhanced security and performance.
    • With version 5.2.5, I have gone above and beyond to ensure that your experience is nothing short of exceptional. I have eliminated numerous bugs, improved annoying pixels, and updated the graphics in a sleek and modern way. The result? A plugin that not only looks great, but works even better.
    • But that’s not all. This update brings seamless integration with the industry’s leading security monitoring platforms-Sentry, Datadog, and Report URI. These integrations offer enhanced reporting capabilities, providing detailed information on content security policy (CSP) violations and improving s…
    • Update: Code optimization for better compatibility with WordPress version 6.9.
    • Fixed: Improved compatibility with WordPress 6.9 plugin list rendering
    • Fixed: Resolved edge case where plugin list could stop rendering when other plugins return unexpected values from the plugin_action_links filter
    • Hardened: Added defensive type checking for better interoperability with third-party plugins
    • By updating to 5.2.5, you’re not just improving your site’s security – you’re optimizing it with the best tools available. Our goal is to provide you with the most beautiful, fastest, and most impressive plugin experience around. So, shall we get started? Hit “update” and step into a new era of sec…

20255 releases

  1. Headers Security Advanced & HSTS WP 5.2.4

  2. Headers Security Advanced & HSTS WP 5.0.45

  3. Headers Security Advanced & HSTS WP 5.0.44

  4. Headers Security Advanced & HSTS WP 5.0.43

  5. Headers Security Advanced & HSTS WP 5.0.42

202410 releases

  1. Headers Security Advanced & HSTS WP 5.0.41

  2. Headers Security Advanced & HSTS WP 5.0.40

  3. Headers Security Advanced & HSTS WP 5.0.39

  4. Headers Security Advanced & HSTS WP 5.0.38

  5. Headers Security Advanced & HSTS WP 5.0.37

  6. Headers Security Advanced & HSTS WP 5.0.36

  7. Headers Security Advanced & HSTS WP 5.0.35

  8. Headers Security Advanced & HSTS WP 5.0.34

  9. Headers Security Advanced & HSTS WP 5.0.33

  10. Headers Security Advanced & HSTS WP 5.0.30

202315 releases

  1. Headers Security Advanced & HSTS WP 5.0.29

  2. Headers Security Advanced & HSTS WP 5.0.28

  3. Headers Security Advanced & HSTS WP 5.0.27

  4. Headers Security Advanced & HSTS WP 5.0.26

  5. Headers Security Advanced & HSTS WP 5.0.25

  6. Headers Security Advanced & HSTS WP 5.0.24

  7. Headers Security Advanced & HSTS WP 5.0.23

  8. Headers Security Advanced & HSTS WP 5.0.22

  9. Headers Security Advanced & HSTS WP 5.0.21

  10. Headers Security Advanced & HSTS WP 5.0.20

  11. Headers Security Advanced & HSTS WP 5.0.19

  12. Headers Security Advanced & HSTS WP 5.0.18

  13. Headers Security Advanced & HSTS WP 5.0.17

  14. Headers Security Advanced & HSTS WP 5.0.16

  15. Headers Security Advanced & HSTS WP 5.0.14

20228 releases

  1. Headers Security Advanced & HSTS WP 5.0.13

  2. Headers Security Advanced & HSTS WP 5.0.10

  3. Headers Security Advanced & HSTS WP 5.0.06

  4. Headers Security Advanced & HSTS WP 5.0.05

  5. Headers Security Advanced & HSTS WP 5.0.04

  6. Headers Security Advanced & HSTS WP 5.0.03

  7. Headers Security Advanced & HSTS WP 5.0.02

  8. Headers Security Advanced & HSTS WP 5.0.01

Questions about Headers Security Advanced & HSTS WP’s releases

What is the latest version of Headers Security Advanced & HSTS WP?

5.3.6, released on Oct 30, 2026 (1 week ago). It’s tested up to WordPress 7.0.8 and needs PHP 7.4 or later.

How often is Headers Security Advanced & HSTS WP updated?

7 releases in the last year, about one every 58 days. Its first release on WordPress.org dates from August 2022.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Headers Security Advanced & HSTS WP’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.