Download

HTTP headers to improve web site security

Door Carl Conrad

Omschrijving

This plug-in helps setting up the various header instructions included in the HTTP protocol allowing for simple improvement of your website security.

This plug-in provides enabling of the following measures:

  • HSTS (Strict-Transport-Security)
  • CSP (Content-Security-Policy)
  • Clickjacking mitigation (X-Frame-Options in main site)
  • XSS protection (X-XSS-Protection)
  • Disabling content sniffing (X-Content-Type-Options)
  • Referrer policy
  • Expect-CT
  • Remove PHP version information from the HTTP header
  • Remove WordPress version information from the header

securityheaders.com is a useful resource for evaluating your web site’s security.

As usual, make sure to understand the meaning of these options and to run full tests on your web site as some options may result in some features stop working.

Schermafdrukken

  • General settings screen.
  • Content-Security-Policy directives settings screen.
  • .htaccess contents screen.

Installatie

  1. Upload the plugin files to the /wp-content/plugins/http-security directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the “Plugins” screen in WordPress.
  3. Use the Settings -> HTTP Security screen to configure the plugin.

FAQ

How can I test the plug-in runs effectively?

Check the HTTP headers of your web site.

Beoordelingen

Good Job

I really like this plugin. I tried others for CSP and I chose this over the others for its ease of use. CSP is complicated enough. By using this plugin it is easier to implement a content security policy and security headers on WordPress. I highly recommend this plugin. Thanks for taking the time to make this plugin.

Perfect

Perfect plugin for the job it needs to do. The developer is great as well!

Perfectly pitched

Really useful plugin for helping with these headers. In addition to https://securityheaders.io also check out your site using https://www.ssllabs.com/ssltest/ for additional feedback. Many thanks.

Facilitating Content Security Policy, X-XSS-Protection, HSTS etc.

I had started writing code in my header and was trying various values for the many directives, after breaking the pages. I decided to look at plugins. The issue was how to speed up the process. This plugin seemed to offer what I needed. In conjunction with the https://securityheaders.io site, I soon attained an 'A' rating. Thank you Conrad for a very useful plugin. This is a great start and I hope you will keep up with the new levels of CSP.
Lees alle 6 beoordelingen

Bijdragers & ontwikkelaars

“HTTP headers to improve web site security” is open source software. De volgende personen hebben bijgedragen aan deze plugin.

Bijdragers

“HTTP headers to improve web site security” is vertaald in 6 talen. Dank voor de vertalers voor hun bijdragen.

Vertaal “HTTP headers to improve web site security” naar jouw taal.

Interesse in ontwikkeling?

Bekijk de code, haal de SVN repository op, of abonneer je op het ontwikkellog via RSS.

Changelog

2.5

  • Added support for Feature-Policy

2.4.2

  • Tested with WordPress 5.0

2.4

  • Added .htaccess instructions

2.3.2

  • Tested with WordPress 4.9

2.3

  • Added support for Expect-CT
  • Cleaned up the interface

2.2

  • Switched to languages packs

2.1

  • Added support for Referrer-Policy directive
  • Added uninstall database cleanup

2.0

  • Added support for all Content-Security-Policy directives
  • Reworked the user interface

1.11

  • Added setting the mode for x-frame-options

1.10.7

  • Removed HSTS header when connected in HTTP

1.10.3

  • Fixed HSTS syntax warning

1.10

  • Added support for Content-Security-Policy

1.9

  • Added critical issues notifications

1.7.5

  • Added max-age option to HSTS setting

1.6

  • Added option to remove WordPress version information from the header

1.5

  • Added option to remove PHP version information from the HTTP header

1.4

  • Included link to submit site preload to browsers
  • Reduced HSTS max-age to one year

1.3

  • Added X-Frame-Options protection.
  • Added X-Content-Type-Options protection.
  • Added HSTS options.

1.1

  • Added XSS protection option.

1.0

  • First stable version providing basic HSTS support.

Meta

Waarderingen

Bekijk alle

Bijdragers

Ondersteuning

Opgeloste problemen in de laatste twee maanden:

0 van de 2

Het supportforum bekijken