Security headers sent twice in responses
Security headers are sent twice in the same response, and the de-duplicate option removes headers that were already single.
Tier II · Emerging Problems that are still building up.
3 public reports · first reported 6 January 2026 · last reported 8 October 2026
What's going wrong
Site owners using this header plugin report that some security headers, such as HSTS and the content security policy, appear two times in the same page response.
AI-assisted: written with the help of AI from the reports. The idea report has the full summary.
In the idea report
- The full summary.
- The products the 3 reports are about, and how many came each month.
- Related problems.
No business has been found with this problem yet, so the report has no contacts. All sales are final — no refunds. Pricing.