內容簡介
Nubivio Security Headers 外掛可協助網站設定重要的安全標頭，發佈自我更新的 security.txt，並檢查網站是否符合 NIS2、EU Cyber Resilience Act、GDPR 和 NEN 7510 等標準，特別適合醫療專業人員使用。
【主要功能】
• 一鍵設定安全標頭與有效的 security.txt
• 可選的合規性掃描功能，提供合規分數
• 自動更新 security.txt 的過期時間
• 檢查網站健康狀況，包括安全標頭驗證
• 支援 Gravity Forms 的電子郵件域名封鎖功能
外掛標籤
開發者團隊
② 後台搜尋「Nubivio Security Headers, security.txt & NIS2 Compliance for Healthcare」→ 直接安裝（推薦）
原文外掛簡介
Set the security headers that matter, publish a self-renewing security.txt (RFC 9116), and check your site against NIS2, the EU Cyber Resilience Act (CRA), GDPR and NEN 7510, all from one settings page. Built for general practitioners, psychologists and other healthcare professionals who need a defensible security baseline without a consultant.
The defaults are safe to ship on a live site, and the plugin is built to move your score on the internet.nl test in the right direction. The compliance features are optional and read-only: they verify and document what you already have, and never change your hardening.
Why healthcare sites use this
One click to a strong header set and a valid security.txt, the two things the internet.nl test and most security reviews check first.
An optional Compliance tab that turns those headers and your security.txt into evidence, mapped to NIS2 Art. 21, CRA Art. 14 and GDPR clauses.
A compliance score with a plain-language breakdown, so you know where you stand and what to fix next.
Available in English and Dutch.
It covers four areas:
Security headers
Strict-Transport-Security (HSTS) with configurable max-age, includeSubDomains and preload
Content-Security-Policy with an internet.nl compliant baseline and a Report-Only test mode
Referrer-Policy with the internet.nl rating shown per value
X-Content-Type-Options (nosniff)
X-Frame-Options
Permissions-Policy
Active removal of the deprecated X-XSS-Protection and Expect-CT headers
Optional COOP, COEP credentialless, CORP and an extended Permissions-Policy
security.txt (RFC 9116)
Writes /.well-known/security.txt and serves it dynamically when the docroot is read-only
Refreshes the Expires field automatically so it never lapses and stays under one year
Fields for Contact, Encryption, Policy, Acknowledgments, Hiring (careers), CSAF, Preferred-Languages and Canonical
Paste your PGP public key and the plugin hosts it at /.well-known/openpgp-key.txt and links it as Encryption automatically
A free-text message to researchers and an optional signature line
CRLF line endings and a valid Canonical URL, exactly as the internet.nl test expects
Compliance scanner (optional, new in 2.2.0)
A Compliance tab with a single compliance score and a red / amber / green band
CRA plugin readiness: checks each active plugin against the WordPress.org directory for update currency, compatibility and abandonment
GDPR checks: detects third-party scripts, forms and consent tooling, and cross-references your Content-Security-Policy
NIS2 Art. 21 signals: encryption in transit, MFA, backups, WAF, activity logging and auto-updates
Site health checks: security.txt validity, live header verification, WordPress and PHP currency, TLS, debug mode, XML-RPC and REST user exposure
WordPress core integrity: verifies your core files against the official WordPress.org checksums and reports modified or missing files (new in 2.3.0)
Access and integrity: an approved administrator baseline, recently created admins, roles and users with unexpected administrator capabilities, an application password audit, a must-use plugin audit and a siteurl sanity check (new in 2.3.0)
Live verification that your configured security headers are actually being sent, not just set
Security headers and security.txt shown as compliance evidence, mapped to the relevant NIS2, CRA and GDPR clauses
HSTS preload readiness, DNS health (SPF, DMARC, DKIM, CAA, MTA-STS, DNSSEC and AAAA), CSP report-only inventory and violation viewer, SRI detector, and TLS certificate overview (new in 2.4.0)
One-click documents generated from your own settings: a Vulnerability Disclosure Policy, a CycloneDX SBOM, an EU and NEN 7510 conformity declaration, and a printable compliance report
Gravity Forms (optional)
Block submissions from one or more email domains, with a custom error message
The section only appears when Gravity Forms is active
This plugin configures headers and a security.txt and helps you document your posture. It is one building block toward NIS2, CRA, GDPR and NEN 7510, not a full compliance programme, and the generated documents are self-assessment starting points, not certifications. It cannot change DNS or server level items such as IPv6, the CAA record, the TLS key-exchange hash or DANE. Those are handled at your host or DNS provider.
External Services
The core hardening features (security headers and security.txt) make no external requests. The optional Compliance tab, introduced in 2.2.0, uses the following external services only when you run a scan (manually or via the optional scheduled scan). Nothing here runs on normal front-end page loads.
WordPress.org Plugins API
When a compliance scan runs, the plugin looks up each active plugin in the WordPress.org Plugins directory to check update currency and compatibility.
What is sent: the public plugin slug only (for example, “akismet”). No personal data, no site data.
When: only during a manual or scheduled compliance scan.
Endpoint: https://api.wordpress.org/plugins/info/1.0/{slug}.json and https://api.wordpress.org/core/version-check/1.7/
Caching: results are cached in a transient for 12 hours.
This is a first-party WordPress.org endpoint. Terms: https://wordpress.org/about/privacy/
WordPress.org Checksums API
When a compliance scan runs, the plugin retrieves the published MD5 checksums for your WordPress version so it can verify that your core files have not been altered.
What is sent: your WordPress version and site locale (for example, “6.8” and “nl_NL”). No personal data, no site data, no file contents. Files are hashed locally and only the hashes are compared.
When: only during a manual or scheduled compliance scan.
Endpoint: https://api.wordpress.org/core/checksums/1.0/
Caching: the checksum list is cached in a transient for 12 hours (1 hour if the request fails).
This is a first-party WordPress.org endpoint. Terms: https://wordpress.org/about/privacy/
Loopback self-request (header and REST probe)
When a compliance scan runs, the plugin makes a request to its own home URL to verify that the configured security headers are actually being sent and to check whether the REST users endpoint exposes user data.
What is sent: a normal HTTP GET to the site’s own home URL. No third-party service is contacted.
When: only during a manual or scheduled compliance scan, or admin/cron context. Never on normal front-end page loads.
Timeout: short (8 seconds). Result cached in a transient for 10 minutes.
If the request fails (some hardened hosts block self-requests), the plugin falls back to showing configured values and reports that live verification was unavailable.
Cloudflare DNS over HTTPS (optional)
When you opt in to DNSSEC validation through Cloudflare DoH, the plugin sends only the site hostname to Cloudflare’s DNS resolver.
What is sent: the site hostname. No personal data or site content.
When: only during a manual or scheduled compliance scan, and only when the optional DNSSEC DoH setting is enabled.
Endpoint: https://cloudflare-dns.com/dns-query
Caching: response is cached in a transient for 6 hours.
Local CSP report endpoint
When CSP report-only is enabled, browsers may POST reports to the local endpoint /wp-json/nubivio-hsh/v1/csp-report. This is not an outbound or third-party service call. Reports are rate-limited and stored as a rolling local option buffer.
