外掛標籤
開發者團隊
原文外掛簡介
Gmcfuerte Security Headers adds the security headers that scanners and hosting audits expect, without editing the
web server configuration, and tells you in plain words what each header does.
What it sends (each one can be switched off):
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN (or DENY)
Referrer-Policy: strict-origin-when-cross-origin (or strict-origin, same-origin, no-referrer)
Permissions-Policy: Basic preset (camera, microphone and location off, also in embedded maps and video) or Strict preset
Strict-Transport-Security (HSTS): off by default, opt-in with a clear warning, max-age from 5 minutes to 1 year, optional includeSubDomains; sent on HTTPS requests only
Removes the X-Powered-By header that reveals your PHP version
Values come from short lists of safe choices, so a typing mistake cannot break your site.
Never twice: a header that WordPress, another plugin or your .htaccess file already sets keeps its value. The plugin
only adds what is missing, and the settings page names the headers it leaves to your .htaccess file.
Self-check: one click reads the headers your home page really sends (including those set by the server, the
.htaccess file or other plugins) and shows, for each one, its status (OK, missing, sent twice, weak, reveals
information), the value received and what it means.
The plugin stores one option with your choices. It sets no cookies and does not collect personal data.
A Pro edition adds a Content-Security-Policy with a Report-Only rollout and script nonces, free-form policy values,
HSTS preload with reverse-proxy checks and 404 responses for version-revealing files. This free plugin works on its
own and does not need it. If both are active, this plugin sends nothing and says so on its settings page. The Pro
sends headers only with a valid licence, so run the self-check to see what your site really sends. Settings do
not carry over.
External services
This plugin does not connect to any external service. The self-check, only when an administrator clicks
“Run the self-check”, makes one HTTP request from your server to your own home page (plus at most three redirects
on the same site) to read its response headers. No data is sent to third parties.
