وضاحت
WP Fix It Easy Security Headers adds a simple page under Tools Security Headers where you can toggle common HTTP security headers:
- Strict-Transport-Security (HSTS)
- Content-Security-Policy (CSP)
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
On activation, all headers are enabled by default and you’re redirected to the settings screen.
For convenience, the page and the Plugins screen include a “Check Headers” button that opens SecurityHeaders.com with your site’s URL prefilled (built dynamically from home_url()).
Notes on CSP
This plugin ships with a permissive default CSP intended to “work everywhere” out of the box (allows most external sources and inline code). For stronger protection, you should harden the directives for your specific site.
Key Features
- One-click toggles for popular headers
- Dynamic “Check Headers” scan link
- Uses the WordPress Settings API (nonce + capability checks)
- Output escaping and sanitization following PHPCS
تصوير
Settings screen with header toggles and “Check Headers” button.
انسٽاليشن
- Upload the plugin folder to
/wp-content/plugins/fix-it-easy-security-headers/or install via Plugins Add New. - Activate the plugin.
- You’ll be redirected to Tools Security Headers. Review and adjust toggles as needed.
- (Optional) Click Check Headers to verify your headers on SecurityHeaders.com.
FAQ
-
Where do I manage the settings?
-
Go to Tools Security Headers.
-
What happens on activation?
-
All header options are enabled and you’re redirected once to the settings page.
-
Will this break my site?
-
Most headers are safe defaults. The provided CSP is intentionally permissive; it shouldn’t block assets. For strict CSPs, tailor directives to your stack and test.
-
Can I use this on multisite?
-
Yes. The “Check Headers” URL is derived from
home_url(). Activation redirect is skipped for network/bulk activations. -
Why don’t I see a “Settings saved” notice twice?
-
The page prints only this plugin’s scoped settings messages to avoid duplicate notices.
-
Can I customize the CSP?
-
Yes. You can modify the
$cspstring insecurity_headers_add_headers()to fit your site’s needs.
جائزا
ھن پلگ ان لاءِ ڪي به رايا ناھن.
تعاون ڪندڙ & ڊولپرز
“Fix It Easy Security Headers” اوپن سورس سافٽ ويئر آهي. ھيٺين ماڻھن ھن پلگ ان ۾ حصو ورتو آھي.
تعاون ڪندڙ
ترجمو ڪريو “Fix It Easy Security Headers” توهان جي ٻولي ۾.
ڊولپمينٽ ۾ دلچسپي؟
ڪوڊ براؤز ڪريو، چيڪ ڪريو SVN مخزن، يا رڪنيت حاصل ڪريو ڊولپمينٽ لاگ پاران RSS.
لاگ تبدیل ڪريو
1.1
- Initial release.
- Header toggles for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
- Activation enables all options and redirects to settings.
- Dynamic SecurityHeaders.com scan link.