內容簡介
總結：安全標頭對保護您的WordPress網站免受常見攻擊至關重要，包括跨網站指令碼（XSS）、點擊劫持、內容嗅探和證書透明度問題。安全標頭外掛提供了一個簡單的介面，只需點擊幾下即可啟用或停用重要的安全標頭。
1. 這個WordPress擴充功能對於保護網站免受哪些常見攻擊特別重要？
- 跨網站指令碼（XSS）、點擊劫持、內容嗅探和證書透明度問題。
2. 這個外掛的主要功能有哪些？
- HTTP嚴格傳輸安全性（HSTS）。
- X-Frame-Options（防止點擊劫持）。
- X-Content-Type-Options（防止MIME類型嗅探）。
- Referrer-Policy（控制引用頭信息）。
- Content-Security-Policy（減輕各種攻擊，如XSS）。
- X-XSS-Protection（防止跨網站指令碼攻擊）。
- Permissions-Policy（控制瀏覽器功能，如麥克風、攝像頭等）。
- X-Permitted-Cross-Domain-Policies（限制跨域資源共享）。
- Expect-CT（強制執行證書透明度）。
- Feature-Policy（控制各種瀏覽器功能的資源加載）。
3. 如何改進網站的安全性而無需手動代碼更改？
- 您可以從WordPress管理面板輕鬆切換每個安全標頭。
外掛標籤
開發者團隊
原文外掛簡介
HTTP Security Header helps protect your WordPress site by adding critical HTTP headers to each response — with no code required. These headers provide additional layers of protection against attacks such as cross-site scripting (XSS), clickjacking, content injection, and resource leaks.
This plugin offers a modern, responsive admin dashboard with validation, fallback safety, and full control over each header’s default or custom value.
🔎 Scan Your Website Security Headers
Before configuring headers, instantly check your website’s current security score using our online header scanner:
👉 Scan Your Website Security Headers
✔ Enter your website URL
✔ Get instant Security Grade (A+ to F)
✔ See which headers are Present or Missing
✔ Get clear, actionable recommendations
✔ Easily fix them using this plugin
Used by thousands of websites to enhance security and protect user data.
Features Include:
– Visual toggles for enabling/disabling headers
– Option to use default or custom header values
– Secure fallback if a header is misconfigured
– Integrated header validation
– Support for all major browser-supported headers
– Nonce-based saving and admin notices
– WP Multisite compatible
– “Disable All” and “Reset to Important Headers” actions
– Per-header input validation with real-time error fallback
Supported Headers:
* Strict-Transport-Security (HSTS)
* X-Frame-Options
* X-Content-Type-Options
* Referrer-Policy
* Content-Security-Policy
* Permissions-Policy
* X-XSS-Protection
* X-Permitted-Cross-Domain-Policies
* Expect-CT
* Cross-Origin-Opener-Policy (COOP)
* Cross-Origin-Resource-Policy (CORP)
* Cross-Origin-Embedder-Policy (COEP)
Features
Lightweight and performance-focused
No front-end impact
Choose default or custom header values
Secure validation and auto-fallbacks
Seamless plugin compatibility (including WP Rocket)
Fully translation-ready and i18n-compliant
Nonce-protected admin save actions
Optional reset-to-default support
Reset or disable all headers with one click
