內容簡介
360 Orbit Header Security 外掛可協助網站更新至最新的 HTTP 安全標頭，增強網站的安全性，並提供靈活的配置選項以滿足不同需求。
【主要功能】
• 支援多種 HTTP 安全標頭設定
• 可個別開啟或關閉每個標頭
• 提供快速啟動按鈕以一鍵設定建議值
• Pro 版支援內容安全政策 (CSP)
• 自動掃描外部服務並提供審核選項
• 自動更新通知功能
外掛標籤
開發者團隊
原文外掛簡介
Header Security brings your website up to date with current HTTP security headers:
Strict-Transport-Security (HSTS)
X-Frame-Options and CSP frame-ancestors (clickjacking protection, even without a full CSP)
X-Content-Type-Options
Referrer-Policy
Permissions-Policy
Cross-Origin-Opener-Policy / Cross-Origin-Resource-Policy
Cookie hardening: adds missing Secure and SameSite attributes to all cookies the website sends
Optional 301 redirect from HTTP to HTTPS
Each header can be switched on and off individually, and its values are fully configurable. A quickstart button enables the recommended settings with a single click.
Free vs. Pro
The free version fully covers all of the basic headers listed above for the frontend.
Header Security Pro adds:
Content Security Policy (CSP), including a report-only mode for a low-risk start.
Learning mode: collects everything the CSP would block for a configurable period and only switches to enforcing once no finding is left unreviewed.
A scanner that automatically detects the external services your site needs (scripts, styles, images, fonts, iframes) and presents them for approval, including bulk approve/block.
Separate header configuration for the backend (wp-admin); WordPress’s own services are allowed automatically.
One address for your site: redirects the other spelling (with or without “www.”) to the address set in WordPress.
Option to load http:// sub-resources over https (upgrade-insecure-requests) as part of the Content Security Policy.
Automatic update notifications directly in the WordPress backend.
