Best csrf plugins for WordPress
The most popular csrf plugins for WordPress in November 2026, in WordPress.org’s own popular order, which follows active installs. SameSite Cookies leads with 700+ active installs, ahead of Comment Form CSRF Protection (400+) and Headit (10+). All 3 plugins tagged “csrf” are below, with figures from WordPress.org that update every day.
Installs aren’t everything: a recent release, a “Tested up to” that matches the current WordPress, and support threads that get resolved show a plugin is looked after. Open any plugin for its downloads, rank history and alternatives.
Research this niche or see all plugins.
Top 3 csrf plugins
- 1.
SameSite CookiesThe most installed csrf plugin, with 700+ active installs. Rated 2.5 from 11 reviews, last updated 3 years ago. Tested only up to WordPress 6.3.14.
- 2.
Comment Form CSRF Protection400+ active installs. Only 2 reviews so far, last updated 3 years ago. Tested only up to WordPress 6.3.14.
- 3.
Headit10+ active installs. No reviews yet, last updated 9 years ago. Tested only up to WordPress 4.4.34.
All 3 plugins tagged “csrf”
SameSite Cookies
Up in the last 7 days:11#7,725by Ayesh Karunaratne3 years ago
CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies.
- Installs
- 700+
- Rating
- 2.5(11)
- Downloads
- 11/day
Comment Form CSRF Protection
Down in the last 7 days:32#9,401by Ayesh Karunaratne3 years ago
Prevent Cross-Site Request Forgery attacks on your comments form.
- Installs
- 400+
- Rating
- 5.0(2)
- Downloads
- 0/day
Headit
#35,312by StampyCode9 years ago
Headit is a simple plugin to allow you to add custom HTTP response headers to your site.
- Installs
- 10+
- Rating
- –
- Downloads
- 0/day