內容簡介
AiutoComputerHelp HTTP Header Audit 外掛用於檢查當前 WordPress 網站的 HTTP 回應標頭，並強調需要檢視的安全控制項。此外掛為唯讀模式，不會修改任何 WordPress 設定或伺服器配置。
【主要功能】
• 檢查 HTTPS 和 HTTP 到 HTTPS 的重導向
• 評估內容安全政策（CSP）和相關條件
• 分析 Cookie 屬性和安全性
• 提供四種結果狀態：通過、檢視、警告和資訊
• 不計算數字安全分數，專注於安全控制的檢查
外掛標籤
開發者團隊
② 後台搜尋「AiutoComputerHelp HTTP Header Audit」→ 直接安裝（推薦）
原文外掛簡介
AiutoComputerHelp HTTP Header Audit checks HTTP response headers returned by the current WordPress site and highlights security controls that deserve review.
The plugin is intentionally read-only. It does not modify WordPress, .htaccess, Apache, Nginx, CDN, reverse proxy, browser policies, or server configuration.
Version 0.3.1 keeps the validated 0.3-series audit behavior unchanged and updates the plugin name, slug, and translation domain for WordPress.org review. The existing checks cover: HTTPS, HTTP-to-HTTPS redirection, redirect-chain integrity, HSTS, Content-Security-Policy, CSP Report-Only, clickjacking protection, X-Content-Type-Options, Content-Type and charset, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, cross-origin isolation prerequisites, basic CORS exposure, Cache-Control, cookie attributes, information disclosure headers, selected obsolete security headers, and obvious conflicting singleton policies.
CSP analysis looks beyond presence or absence. It reviews high-signal conditions such as unsafe-eval, unsafe-inline without a nonce or hash, wildcard script sources, object-src, base-uri, and frame-ancestors.
The audit uses four result states: Pass, Review, Warning, and Info. A missing header is not automatically a vulnerability, and a present header does not prove that a site is secure. Some policies are application-specific deployment choices. The plugin intentionally does not calculate a numeric security score.
For safety, the audit accepts only URLs on the current WordPress site’s host and follows redirects only while they remain on that host.
Cookie auditing checks objective Set-Cookie attribute relationships and prefix requirements without exposing cookie values. The absence of Secure, HttpOnly, or SameSite is not automatically treated as a vulnerability because the correct choice depends on the cookie’s purpose.
Active origin-reflection probing, preflight simulation, deep CORS authorization testing, Clear-Site-Data, scheduled monitoring, and configuration suggestions remain outside the scope of this plugin. Basic CORS analysis validates response-header syntax and a few objective incompatibilities without assuming that public wildcard access or a specific allowed origin is inherently unsafe.
