內容簡介
Jeelsh HTTP Headers 外掛提供簡單直觀的介面，讓使用者能夠直接在 WordPress 控制台中配置 HTTP 回應標頭，提升網站的安全性和合規性。
【主要功能】
• 輕鬆配置內容安全政策 (Content-Security-Policy, CSP) 標頭
• 實施 HTTP 嚴格傳輸安全 (HTTP Strict Transport Security, HSTS)
• 設定參考政策 (Referrer-Policy)、X-Frame-Options 和 Permissions-Policy
• 添加自訂的 HTTP 標頭
外掛標籤
開發者團隊
原文外掛簡介
Jeelsh HTTP Headers provides an intuitive interface to configure HTTP response headers directly from your WordPress dashboard, helping you improve your site’s security posture and compliance.
Key Features
Easily configure Content-Security-Policy (CSP) headers.
Implement HTTP Strict Transport Security (HSTS).
Set Referrer-Policy, X-Frame-Options, and Permissions-Policy.
Add your own custom HTTP headers.
External Services
This plugin does not connect to any third-party service by default. The following items are documented for transparency:
Vite development server: When the plugin is in development mode (configurable in Config/React.php as ‘develop’), it loads JavaScript modules and HMR WebSocket messages from the configured local Vite server (default http://localhost:3000). No user data is transmitted. This connection is only active when a developer explicitly enables development mode and runs the Vite server locally.
CSP report-uri: If you configure a report-uri in the CSP settings, the browser will send CSP violation reports to the user-provided URL. The plugin does not provide or operate that endpoint; the site administrator chooses and controls it. By default the report-uri field is empty and no reports are sent.
Example domains in settings fields: Inputs such as https://example.com and https://api.example.com use IANA-reserved example domains as placeholders only. The plugin does not connect to them.
GitHub documentation link: The admin sidebar includes a link to https://github.com/jeelsh/http-headers-advanced. It opens only when a user clicks it. GitHub is operated by GitHub, Inc.; for terms and privacy, see https://docs.github.com/en/site-policy/github-terms/github-terms-of-service and https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement.
Support email link: The admin sidebar includes a mailto:[email protected] link. It opens the user’s email client; the plugin does not send any data.
WordPress REST API and admin-ajax: Saving and validating settings uses the site’s own WordPress REST API endpoints and admin-ajax.php. These are same-site, internal communications.
Source Code
The plugin’s user interface is built with React. The compiled, production-ready files are in assets/dist/. The human-readable source code and build tooling are maintained at https://github.com/jeelsh/http-headers-advanced.
To review or rebuild the JavaScript and CSS from source, clone the repository and run:
npm install
npm run build
For end users, the plugin works out of the box with the pre-built assets in assets/dist/.
