WordPress plugin2024 – Present

HTTP Security Header WordPress Plugin

HTTP Security Header is a WordPress.org plugin by Mohit Goyal in PHP that adds CSP, HSTS and security headers from a settings screen, now at 1,000+ installs.

Timeline

2024 – Present

Stack

PHPWordPressJavaScriptWordPress.org

About the project

It exists so that site owners can pass a security header scan without editing server configuration they are rightly afraid to touch. Most WordPress sites fail security header scans. The fix is well known, but adding headers means editing .htaccess or the server config. Site owners will not touch that, and many agencies would rather not be responsible for it. The result is that sites stay exposed to clickjacking, content sniffing and cross-site scripting that a few response headers would mitigate. I wrote this plugin so that anyone can turn on the important headers from Settings > Security Headers, with sensible defaults and validation, and without a trip into the hosting panel. The plugin covers Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, X-Permitted-Cross-Domain-Policies and Feature-Policy. Each header has its own settings with defaults that are safe to switch on, and the values are validated before they are saved. The part I care most about is the fallbacks. A bad Content-Security-Policy or a mistyped frame option cannot lock an admin out of their own site, because the plugin falls back to a working value rather than serving a header that breaks the dashboard. I published it to WordPress.org in November 2024 and have shipped updates through version 3.1. It is built in PHP for WordPress 5.0 and above. It sends headers from WordPress itself rather than from the web server, which makes it portable across Apache, Nginx and managed hosts where the owner has no config access. The settings screen uses the standard WordPress settings API, so it behaves like core and is easy to audit. Around the plugin I wrote a 15-article explainer series covering each header in turn. The series doubles as documentation and as the content that brings people to the plugin. I also built a companion online scanner on inspiredmonks.com that grades a site from A+ to F, so an owner can see the problem before installing the fix. At the time of writing the plugin reports more than 1,000 active installs, about 6,900 downloads and a 5 out of 5 rating on WordPress.org. Site owners who could never have edited a server file can now pass a header audit in a few minutes. Agencies I work with install it as a standard part of a build. The lesson from maintaining it has been that safe defaults and fallbacks matter more than coverage. A plugin that cannot break a site gets left switched on. Need a WordPress plugin built or hardened for your own site or product? Send me the requirements and I will reply with a plan.

Gallery

Related projects

WordPress plugin

Geo Targeting for Bricks Builder

2025 – Present

Geo Targeting for Bricks Builder is a WordPress.org plugin by Mohit Goyal that shows or hides Bricks elements by visitor country, resolved via IPinfo Lite. I published it in November 2025 and maintain it alongside my HTTP Security Header plugin. It is currently at version 1.5.1 and tested up to WordPress 6.9. Bricks Builder has a conditions system but no way to vary content by location. Agencies serving several countries were duplicating pages: one for each region, with the same layout and different prices, phone numbers or offers. That is slow to build and worse to maintain. The goal was a country condition that any Bricks element could carry, with the lookup done in a way that did not flash the wrong content first or store anything about the visitor. The plugin adds a country condition to any Bricks element. Site owners add their IPinfo token in the plugin settings, then pick countries to include or exclude on an element: pricing in the right currency, local phone numbers, region-specific offers. The lookup runs on the server through IPinfo Lite, so there is no client-side flicker and no personal data stored. I wrote the companion guide on getting an IPinfo API token, so a site owner can go from install to a working condition without leaving the documentation. The stack is PHP and WordPress, built against the Bricks Builder conditions API and the IPinfo REST API, and distributed through WordPress.org. Resolving the country on the server was the central decision. A client-side lookup would render the default content first and swap it after the request returned, which is visible to the visitor and bad for layout stability. Doing it in PHP before the page renders avoids that. Nothing is written to the database, so the plugin has no personal data to protect. It requires WordPress 6.0 or later and PHP 7.4 or later. The plugin is young and has a small install base; no usage metrics beyond that are measured. Bricks site owners can now keep one page per layout and let the country condition decide what each visitor sees, with no duplicate pages to keep in sync. It is live on WordPress.org at wordpress.org/plugins/geo-targeting-for-bricks-builder. Need a Bricks Builder or WordPress plugin built for a gap in your workflow? Send me the idea and I will reply with a plan.

PHP WordPress Bricks Builder REST API

Agency website

Inspired Monks Development

2023 – Present

Inspired Monks is my freelance web development brand: a fast WordPress agency site built by Mohit Goyal with 75 blog posts, free tools and case studies. It serves clients across India, and it is both the storefront for my freelance practice and the testing ground where I prove the performance work I sell. The site has two jobs. The first is to win work. A prospect needs to see services, real case studies and evidence that the site itself is quick, because a slow agency site undermines every performance claim on it. The second is to be a laboratory. It is where I try caching strategies, header configurations and builder techniques on a real production site before using them on a client. The challenge in meeting both is that the site runs on Elementor, a page builder that is convenient for content but not naturally fast. The site is WordPress with Elementor, tuned for speed with lazy loading, image optimisation and custom caching logic. That gets it top Lighthouse performance scores despite the builder. Beyond the service pages it hosts case studies for Nortek LED, Orilite, IIID Inscape and CyberVie, each with deliverables, approach and outcomes. A client wall includes Janssen, IPL Biologicals, PropAlert, Taxocity, Aura Clips and Easy Parenting Hub. The blog holds 75 articles I have written on WordPress, Core Web Vitals, HTTP headers, SEO and freelancing. They are organised into categories such as web development, tips, HTTP headers, tools and WordPress plugins. The site also serves the free tools I built: the HTTP Security Header Scanner, the AI Proposal Generator, the Free Invoice Generator and Humora. Under1MB is linked from the footer alongside my WordPress plugins. The stack is WordPress, Elementor, PHP, JavaScript and Yoast SEO. Keeping Elementor was a deliberate choice, because the site is also where I write, and a builder makes publishing long-form content and tool landing pages quick. The performance cost is paid back with custom caching logic in PHP, lazy loading for images and embeds, and image optimisation at upload. That is the same recipe I apply to client sites. Yoast handles the on-page SEO for a content library this size. The free tools run as pages on the same install, so they share the hosting and the brand without separate deployments. The site is live at inspiredmonks.com and is where most of my freelance enquiries begin. I own every part of it: design, build, content and hosting. The most useful outcome has been the content and tools flywheel. The HTTP header articles bring readers to the scanner, the scanner points to the plugin, and the whole thing shows prospects that I can make a page builder site fast. Running an Elementor site that feels slow? Send me the URL and your goals and I will reply with a plan.

WordPress Elementor PHP JavaScript

Corporate website

FARE Labs Company Website

2023 – 2024

FARE Labs company website and landing pages on WordPress and Elementor, built and maintained by Mohit Goyal as the lab's in-house developer and team lead. This was not a freelance job. From March 2023 to April 2024 I worked full-time at FARE Labs in Gurugram. I owned farelabs.com and everything the marketing team needed online, from the main company site to the pages and assets behind its email and social media campaigns. FARE Labs is a testing and calibration lab. Its website had to explain a technical set of services, testing, calibration and certification, to customers who arrive from a search result or a campaign link. It had to do that on a phone as reliably as on a desktop. The marketing team also needed new landing pages on a regular cadence for campaigns and service launches, with forms that reached the sales team without delay. The goal was a site that stayed fast, consistent across browsers and easy to extend as new services and campaigns came up. I built and maintained the responsive company site on WordPress with Elementor, covering the lab's testing, calibration and certification services. I kept it consistent across browsers and fast on mobile. Alongside the main site I produced marketing landing pages for campaigns and service launches, each with forms wired to the sales team so enquiries landed with the right people. I supported the company's email and social media campaigns by building the pages and assets they pointed to. A campaign could go out knowing the destination page matched the message. The stack was WordPress and Elementor, with HTML, CSS, JavaScript and PHP customisation on top of the Elementor build wherever the page builder stopped short. I chose to stay on Elementor rather than rebuild from scratch because the marketing team already knew it and could make routine edits themselves. That kept my time for the work that needed code: performance tuning, custom layouts, form behaviour and the on-page SEO work that a lab site depends on for service queries. As team lead I also coordinated the small web team so requests from marketing moved through in order. The outcome was a company site and a steady stream of campaign landing pages that the marketing team could rely on, served fast on mobile and consistent in every browser I tested. No performance or traffic metrics were measured for this work. The team could launch a campaign with a matching landing page and a working form, and the services content stayed current without waiting on an agency. The site is live at farelabs.com. Need an in-house style developer for a company site and its campaign pages, without the hire? Send me the details and I will reply with a plan.

WordPress Elementor PHP JavaScript

Let's build

Have a site that needs to be fast, rank and convert?

Open to Work. Usually replies within a day.