內容簡介
Jeelsh HTTP Headers 是一款簡單易用的 WordPress 外掛，讓使用者能夠在控制台中設定 HTTP 回應標頭，以提升網站的安全性和合規性。
【主要功能】
• 設定內容安全政策 (CSP) 標頭
• 支援 HTTP 嚴格傳輸安全 (HSTS)
• 自訂標頭支援
• 設定驗證功能
• 直觀的 React 管理面板
外掛標籤
開發者團隊
原文外掛簡介
Jeelsh HTTP Headers gives you an easy-to-use interface inside your WordPress dashboard to set HTTP response headers that improve your site’s security and compliance.
With this plugin you can configure:
Content-Security-Policy (CSP) headers
HTTP Strict Transport Security (HSTS)
Referrer-Policy
X-Frame-Options
Permissions-Policy
X-Content-Type-Options
X-Permitted-Cross-Domain-Policies
Your own custom headers
All settings are validated and applied safely without touching your site’s core files.
Features
Intuitive React-based admin panel
Predefined security headers with helpful descriptions
Custom header support
Settings validation before saving
Works out of the box with pre-built assets
No external service dependencies by default
Requirements
WordPress 5.0 or higher
PHP 7.4 or higher
External Services
This plugin does not connect to any third-party service by default. The following items are documented for transparency:
CSP report-uri: If you configure a report-uri in the CSP settings, the browser will send CSP violation reports to the user-provided URL. The plugin does not provide or operate that endpoint; the site administrator chooses and controls it. By default the report-uri field is empty and no reports are sent.
Example domains in settings fields: Inputs such as https://example.com and https://api.example.com use IANA-reserved example domains as placeholders only. The plugin does not connect to them.
GitHub documentation link: The admin sidebar includes a link to https://github.com/jeelsh/http-headers. It opens only when a user clicks it. GitHub is operated by GitHub, Inc.; for terms and privacy, see https://docs.github.com/en/site-policy/github-terms/github-terms-of-service and https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement.
Support email link: The admin sidebar includes a mailto:[email protected] link. It opens the user’s email client; the plugin does not send any data.
WordPress REST API and admin-ajax: Saving and validating settings uses the site’s own WordPress REST API endpoints and admin-ajax.php. These are same-site, internal communications.
Privacy
Jeelsh HTTP Headers does not collect, store, or transmit any personal data on its own. All header configuration is stored in your WordPress database. The only optional external communication is a CSP report-uri that you, the site administrator, choose to configure.
Support
For help, documentation, and bug reports, visit the GitHub repository: https://github.com/jeelsh/http-headers
For direct support, you can also email [email protected].
Development
The plugin’s user interface is built with React. The source code is available for review on GitHub: https://github.com/jeelsh/http-headers
For build and development instructions, see DEVELOPMENT.md.
