Security Header Profiles

Description: Apply pre-built security profiles such as Relaxed / Balanced / Strict (Pro). How it works: Profiles set multiple header values together, making it easier to adopt best-practice defaults. How to access / configure: WP Admin → AegisShield → Security Headers → Profiles (Pro). Select a profile. Save and test key site pages. Recommended setting: Start with Balanced; move to Strict after CSP violations are addressed.

Description: Add custom directives to CSP when you need advanced control (Pro). How it works: builder_extra_directives and builder_extra_mode append additional CSP rules beyond the guided fields. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Enter extra directives. Save and test. Recommended setting: Only use if you understand CSP; validate directives to avoid breaking the site.

Description: Restricts which sites can embed your site in an iframe (anti-clickjacking) (Pro). How it works: builder_frame_ancestors sets the CSP frame-ancestors directive; pairs well with X-Frame-Options. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Set frame ancestors to 'none' or 'self'. Save changes. Recommended setting: Use 'none' for most sites; 'self' if you embed your own pages internally.

Description: Controls which endpoints your site can connect to (AJAX, APIs) via CSP connect-src (Pro). How it works: builder_connect_src and builder_connect_mode define allowed origins for fetch/XHR/WebSocket connections. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Connect settings. Add API domains and Save Changes. Recommended setting: Only allow your own domain and required external APIs (payments, analytics, etc.).

Description: Defines allowed font sources for CSP (Pro). How it works: builder_font_src and builder_font_mode control allowed origins for fonts. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Font settings. Add required domains and Save Changes. Recommended setting: If using Google Fonts, allow only the needed domains; otherwise keep to 'self'.

Description: Defines allowed image sources for CSP (Pro). How it works: builder_img_src and builder_img_mode define allowed origins for images; helps prevent data exfil via image beacons. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Image settings. Add required domains and Save Changes. Recommended setting: Allow 'self' and your media/CDN domains; avoid allowing all.

Description: Defines allowed style sources for CSP (Pro). How it works: builder_style_src and builder_style_mode define allowed origins for stylesheets. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Style settings. Add required domains and Save Changes. Recommended setting: Keep to 'self' + required CDN domains only.

Allow Inline CSS in CSP

Description: Allows or blocks inline CSS (unsafe-inline) in CSP (Pro). How it works: builder_allow_inline_css controls whether inline styles are permitted; disabling reduces injection risk but may require theme adjustments. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Toggle “Allow inline CSS”. Save and test layout. Recommended setting: Prefer OFF if possible; otherwise keep ON but restrict other directives tightly.

Allow Inline JavaScript in CSP

Description: Allows or blocks inline JS (unsafe-inline) in CSP (Pro). How it works: builder_allow_inline_js controls whether inline scripts are permitted; disallowing improves security but may break some themes/plugins. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Toggle “Allow inline JS”. Save and test site functionality. Recommended setting: Prefer OFF; only enable if required and plan to migrate to nonces/hashes later.

Description: Controls whether CSP is built from presets, custom lists, or a guided builder (Pro). How it works: builder_mode defines how directives are assembled, which sources are included, and whether extra directives are appended. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Select Builder Mode. Save changes. Recommended setting: Use the guided builder first; move to custom directives only if you understand CSP well.

News & Events

Categories: AegisShield
Security Header Profiles
read more
Categories: AegisShield
Extra CSP Directives
read more
Categories: AegisShield
Frame Ancestors
read more
Categories: AegisShield
CSP Connect Sources
read more
Categories: AegisShield
CSP Font Sources
read more
Categories: AegisShield
CSP Image Sources
read more
Categories: AegisShield
CSP Style Sources
read more
Categories: AegisShield
Allow Inline CSS in CSP
read more
Categories: AegisShield
Allow Inline JavaScript in CSP
read more
Categories: AegisShield
CSP Builder Mode
read more

keep updated & don’t miss anything!

We regularly develop new plugins and release them for free because they’re solutions we trust and use ourselves.

By entering your email, you agreed to our Privacy Policy and Terms & Conditions

Frequently Asked Questions

Support Docs

Ticketing System

profiles security balanced strict pro description apply pre built relaxed works set multiple header values together making easier adopt best practice defaults access configure admin aegisshield headers select profile save test key site pages recommended setting start move csp violations addressed

Powered by Aegisify Links

2026 - Aegisify.com - Everything Your WordPress Site Needs, One Platform. One Price.

Privacy Policy * Terms of Use * Free Plugin Disclaimer * End User License Agreement