內容簡介
WP Anti-Clickjack 是一款強大的安全外掛，旨在防止您的 WordPress 網站受到 clickjacking 攻擊。透過實施兩項關鍵防護機制，該外掛確保網站的安全性與完整性。
【主要功能】
• 添加 X-Frame-Options 和 Content-Security-Policy HTTP 標頭以防止 clickjacking
• 與現有的 Content-Security-Policy 兼容，保留伺服器或其他外掛的標頭
• 提供網站健康檢查，檢測頁面快取或伺服器設定
• 包含修改版的 OWASP 瀏覽器框架破壞腳本
• 支援流行的頁面建構器和編輯器，如 Elementor 和 Divi
• 易於安裝和配置，定期更新以兼容最新版本的 WordPress
外掛標籤
開發者團隊
📦 歷史版本下載
原文外掛簡介
WP Anti-Clickjack is a powerful security plugin that helps prevent your WordPress site from being vulnerable to clickjacking attacks. Clickjacking is a malicious technique where an attacker tricks users into clicking on a concealed link or button by overlaying it on your legitimate website.
This plugin implements two key defense mechanisms:
Frame protection headers: The plugin adds the X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' HTTP headers to your site’s pages. They instruct web browsers to prevent other websites from embedding your site within an iframe, effectively blocking clickjacking attempts. A Content-Security-Policy your site already sends is left in place, and WordPress post embeds stay embeddable on other sites.
OWASP’s Legacy Browser Frame Breaking Script: The plugin includes a modified version of OWASP’s legacy browser frame breaking script. This script prevents other sites from putting your site in an iframe, even in browsers that don’t support the X-Frame-Options header. The script is optimized to work seamlessly in browsers with and without JavaScript enabled.
By combining these two security measures, WP Anti-Clickjack provides comprehensive protection against clickjacking attacks, ensuring the safety and integrity of your WordPress site.
For more information about clickjacking defense techniques, refer to the OWASP Clickjacking Defense Cheat Sheet.
Features
Adds the X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' HTTP headers to prevent clickjacking
Works alongside your existing Content-Security-Policy, including nonce-based policies, and keeps framing headers your server or another plugin already sends
Settings > Anti-Clickjack screen to let sites you choose (like your other domains or a partner) frame your site, also available as the wp_anti_clickjack_allowed_origins filter
Site Health check that loads your homepage like a visitor and warns if a page cache, CDN or server setting drops or duplicates the headers
“Check from outside” button that has ClickJack Test load your homepage from the internet, through your CDN, and shows what it sees
“Test your site” link on the Plugins screen
Includes a modified version of OWASP’s legacy browser frame breaking script
Compatible with popular page builders and editors like Elementor, Divi, WPBakery, Bricks, Breakdance, Oxygen, and more
Provides filters to disable the anti-clickjacking measures when needed
Easy to install and configure
Regularly updated and tested with the latest WordPress versions
Additional Details
To disable the clickjacking JavaScript, use the following filter in your theme’s functions.php file. It receives true or false and runs last, so you can also return false only on specific pages:
add_filter('wp_anti_clickjack', '__return_false');
To disable the clickjacking HTTP headers (X-Frame-Options and Content-Security-Policy: frame-ancestors), use this filter in your theme’s functions.php file:
add_filter('wp_anti_clickjack_x_frame_options_header', '__return_false');
To let other sites put your site in a frame, add them under Settings > Anti-Clickjack, one per line. Developers can use this filter instead (it also receives the sites saved in the settings). Wildcards work for subdomains, and the frame breaking script allows the same sites:
add_filter( 'wp_anti_clickjack_allowed_origins', function ( $origins ) {
$origins[] = 'https://partner.example';
$origins[] = 'https://*.example.com';
return $origins;
} );
If your WordPress admin runs on a different domain than your site, that domain is allowed automatically so page builders and previews keep working.
Page builder and editor previews are detected only for logged-in users who can edit posts, so a visitor cannot switch the protection off by adding a page builder parameter to a URL.
If your server, CDN or another plugin already sends an X-Frame-Options header or a frame-ancestors policy, the plugin leaves them as they are and doesn’t add its own.
External services
The “Check from outside” button and the “Test your site” link use ClickJack Test, a free clickjacking tester. Nothing is sent unless an administrator clicks one of them. When they do, your homepage address is sent to clickjacktest.com, which requests that address from the internet and reports the framing headers it receives. No other data about your site or its users is sent. See ClickJack Test’s terms of use and privacy policy.
