| 1 |
=== HTTP Headers === |
| 2 |
Contributors: zinoui |
| 3 |
Donate link: https://zinoui.com/donation |
| 4 |
Tags: custom headers, http headers, headers, security, http header, header, cross domain, cors, xss, clickjacking, mitm, cross origin, cross site, privacy, p3p, hsts, referrer, csp, caching, compression, access control, authentication |
| 5 |
Requires at least: 3.2 |
| 6 |
Tested up to: 5.2.3 |
| 7 |
Stable tag: 1.14.1 |
| 8 |
License: GPLv2 or later |
| 9 |
|
| 10 |
HTTP Headers adds CORS & security HTTP headers to your website. |
| 11 |
|
| 12 |
== Description == |
| 13 |
|
| 14 |
HTTP Headers gives your control over the http headers returned by your blog or website. |
| 15 |
|
| 16 |
Headers supported by HTTP Headers includes: |
| 17 |
|
| 18 |
* Access-Control-Allow-Origin |
| 19 |
* Access-Control-Allow-Credentials |
| 20 |
* Access-Control-Max-Age |
| 21 |
* Access-Control-Allow-Methods |
| 22 |
* Access-Control-Allow-Headers |
| 23 |
* Access-Control-Expose-Headers |
| 24 |
* Age |
| 25 |
* Content-Security-Policy |
| 26 |
* Content-Security-Policy-Report-Only |
| 27 |
* Cache-Control |
| 28 |
* Clear-Site-Data |
| 29 |
* Connection |
| 30 |
* Content-Encoding |
| 31 |
* Content-Type |
| 32 |
* Expect-CT |
| 33 |
* Expires |
| 34 |
* Feature-Policy |
| 35 |
* Pragma |
| 36 |
* Public-Key-Pins |
| 37 |
* Public-Key-Pins-Report-Only |
| 38 |
* P3P |
| 39 |
* Referrer-Policy |
| 40 |
* Report-To |
| 41 |
* Strict-Transport-Security |
| 42 |
* Timing-Allow-Origin |
| 43 |
* Vary |
| 44 |
* WWW-Authenticate |
| 45 |
* X-Content-Type-Options |
| 46 |
* X-DNS-Prefetch-Control |
| 47 |
* X-Download-Options |
| 48 |
* X-Frame-Options |
| 49 |
* X-Permitted-Cross-Domain-Policies |
| 50 |
* X-Powered-By |
| 51 |
* X-UA-Compatible |
| 52 |
* X-XSS-Protection |
| 53 |
|
| 54 |
The [getting started tutorial](https://zinoui.com/blog/http-headers-for-wordpress) describes a typical configuration of this plugin. |
| 55 |
|
| 56 |
== Installation == |
| 57 |
|
| 58 |
Upload the HTTP Headers plugin to your blog. Then activate it. |
| 59 |
|
| 60 |
That's all. |
| 61 |
|
| 62 |
== Frequently Asked Questions == |
| 63 |
|
| 64 |
= Why to use this plugin? = |
| 65 |
|
| 66 |
Nowadays security of your social data at the web is essential. This plugin helps you to improve your website overall security. |
| 67 |
|
| 68 |
= Who use these headers? = |
| 69 |
|
| 70 |
These HTTP headers are being used in production services by popular websites as Facebook, Google+, Twitter, LinkedIn, YouTube, Yahoo, Amazon, Instagram, Pinterest. |
| 71 |
|
| 72 |
== Screenshots == |
| 73 |
|
| 74 |
1. This screenshot shows up the dashboard with categories of the supported headers. |
| 75 |
2. This screenshot shows up the headers of a chosen category and their current values. |
| 76 |
3. This screenshot shows up the settings page where you can adjust the security headers. |
| 77 |
4. This screenshot shows up the response headers returned by the web server. |
| 78 |
|
| 79 |
== Upgrade Notice == |
| 80 |
|
| 81 |
Updates are on they way, so stay tuned at [@DimitarIvanov](https://twitter.com/DimitarIvanov) |
| 82 |
|
| 83 |
== Changelog == |
| 84 |
|
| 85 |
= 1.14.1 = |
| 86 |
*Release Date - 15th September, 2019* |
| 87 |
|
| 88 |
* Simple filtering was replaced with Dynamic filtering |
| 89 |
|
| 90 |
= 1.14.0 = |
| 91 |
*Release Date - 1st September, 2019* |
| 92 |
|
| 93 |
* Added the "Content-Type" header |
| 94 |
* Fixed the "Access-Control-Allow-Credentials" header |
| 95 |
* Improvement to "Access-Control-Allow-Headers" header |
| 96 |
* Improvement to "Access-Control-Allow-Methods" header |
| 97 |
* Improvement to "Access-Control-Expose-Headers" header |
| 98 |
* Improvement to "Cache-Control" header |
| 99 |
* Improvement to "Vary" header |
| 100 |
|
| 101 |
= 1.13.4 = |
| 102 |
*Release Date - 14th July, 2019* |
| 103 |
|
| 104 |
* Added the "always" condition to Header (unset) directive |
| 105 |
* Fixed the "import" function |
| 106 |
* Fixed the "Access-Control-Allow-Origin" header |
| 107 |
|
| 108 |
= 1.13.3 = |
| 109 |
*Release Date - 16th June, 2019* |
| 110 |
|
| 111 |
* Bugfix in "WWW-Authenticate" header |
| 112 |
* Added support of Apache 2.4 |
| 113 |
|
| 114 |
= 1.13.2 = |
| 115 |
*Release Date - 13th June, 2019* |
| 116 |
|
| 117 |
* Bugfix in "Content-Encoding" header |
| 118 |
* Bugfix in "Vary" header |
| 119 |
|
| 120 |
= 1.13.1 = |
| 121 |
*Release Date - 8th June, 2019* |
| 122 |
|
| 123 |
* Added Brotli compression |
| 124 |
|
| 125 |
= 1.13.0 = |
| 126 |
*Release Date - 7th June, 2019* |
| 127 |
|
| 128 |
* Added "SameSite" to Cookie Security |
| 129 |
* Fixed import/export function |
| 130 |
* Code refactoring |
| 131 |
|
| 132 |
= 1.12.2 = |
| 133 |
*Release Date - 5th April, 2019* |
| 134 |
|
| 135 |
* UI improvement for Content-Security-Policy |
| 136 |
* Fix for Access-Control-Allow-Headers |
| 137 |
* Fix for Access-Control-Allow-Origin |
| 138 |
* Fix for Feature-Policy |
| 139 |
|
| 140 |
= 1.12.1 = |
| 141 |
*Release Date - 9th January, 2019* |
| 142 |
|
| 143 |
* Remove direct calls to cURL |
| 144 |
|
| 145 |
= 1.12.0 = |
| 146 |
*Release Date - 5th January, 2019* |
| 147 |
|
| 148 |
* Better handling of activate/deactivate functions |
| 149 |
|
| 150 |
= 1.11.0 = |
| 151 |
*Release Date - 9th December, 2018* |
| 152 |
|
| 153 |
* Added support of "Clear-Site-Data" header |
| 154 |
|
| 155 |
= 1.10.5 = |
| 156 |
*Release Date - 6th November, 2018* |
| 157 |
|
| 158 |
* Hotfix: parallel work with third-party plugins |
| 159 |
|
| 160 |
= 1.10.4 = |
| 161 |
*Release Date - 30th September, 2018* |
| 162 |
|
| 163 |
* Support of following Server APIs: CGI, FastCGI, PHP-FPM |
| 164 |
* Error handling improvement |
| 165 |
|
| 166 |
= 1.10.3 = |
| 167 |
*Release Date - 8th August, 2018* |
| 168 |
|
| 169 |
* HSTS improvement |
| 170 |
* CORS improvement |
| 171 |
|
| 172 |
= 1.10.2 = |
| 173 |
*Release Date - 31st July, 2018* |
| 174 |
|
| 175 |
* Export feature bug-fixed |
| 176 |
|
| 177 |
= 1.10.1 = |
| 178 |
*Release Date - 18th July, 2018* |
| 179 |
|
| 180 |
* Feature-Policy header update: new features added |
| 181 |
|
| 182 |
= 1.10.0 = |
| 183 |
*Release Date - 17th July, 2018* |
| 184 |
|
| 185 |
* Added support of "Feature-Policy" header |
| 186 |
|
| 187 |
= 1.9.5 = |
| 188 |
*Release Date - 12th July, 2018* |
| 189 |
|
| 190 |
* CORS bugfix |
| 191 |
|
| 192 |
= 1.9.4 = |
| 193 |
*Release Date - 13th January, 2018* |
| 194 |
|
| 195 |
* In-plugin security improvement |
| 196 |
|
| 197 |
= 1.9.3 = |
| 198 |
*Release Date - 10th January, 2018* |
| 199 |
|
| 200 |
* Bug fix |
| 201 |
|
| 202 |
= 1.9.2 = |
| 203 |
*Release Date - 4th January, 2018* |
| 204 |
|
| 205 |
* Security improvements |
| 206 |
|
| 207 |
= 1.9.1 = |
| 208 |
*Release Date - 27th December, 2017* |
| 209 |
|
| 210 |
* Updated translations |
| 211 |
|
| 212 |
= 1.9.0 = |
| 213 |
*Release Date - 23th December, 2017* |
| 214 |
|
| 215 |
* Added support of "Report-To" header |
| 216 |
* Added support of translations |
| 217 |
* Added support of Import/Export |
| 218 |
* Updated "Content-Security-Policy" header (added directives: object-src, frame-src, worker-src, manifest-src, base-uri, report-to) |
| 219 |
* Updated "WWW-Authenticate" header (support multiple users) |
| 220 |
* Updated "Access-Control" headers (added list of origins) |
| 221 |
|
| 222 |
= 1.8.0 = |
| 223 |
*Release Date - 31st August, 2017* |
| 224 |
|
| 225 |
* Added support of "Timing-Allow-Origin" header |
| 226 |
* Added support of "X-Download-Options" header |
| 227 |
* Added support of "X-DNS-Prefetch-Control" header |
| 228 |
* Added support of "X-Permitted-Cross-Domain-Policies" header |
| 229 |
* Added support of Custom headers |
| 230 |
|
| 231 |
= 1.7.1 = |
| 232 |
*Release Date - 18th August, 2017* |
| 233 |
|
| 234 |
* PHP notice bugfixed |
| 235 |
|
| 236 |
= 1.7.0 = |
| 237 |
*Release Date - 15th August, 2017* |
| 238 |
|
| 239 |
* Added support of "Content-Security-Policy-Report-Only" header |
| 240 |
* Added support of "Public-Key-Pins-Report-Only" header |
| 241 |
* Added "1; report=<reporting-URI>" directive to the "X-XSS-Protection" header |
| 242 |
* Added "Inspect headers" tool |
| 243 |
* UI bugfixes |
| 244 |
|
| 245 |
= 1.6.0 = |
| 246 |
*Release Date - 5th August, 2017* |
| 247 |
|
| 248 |
* Added support of "Expect-CT" header |
| 249 |
|
| 250 |
= 1.5.0 = |
| 251 |
*Release Date - 30th July, 2017* |
| 252 |
|
| 253 |
* Added support of "Age" header |
| 254 |
* Added support of "Cache-Control" header |
| 255 |
* Added support of "Connection" header |
| 256 |
* Added support of "Content-Encoding" header |
| 257 |
* Added support of "Expires" header |
| 258 |
* Added support of "Pragma" header |
| 259 |
* Added support of "Vary" header |
| 260 |
* Added support of "WWW-Authenticate" header |
| 261 |
* Added support of "X-Powered-By" header |
| 262 |
* Added support of "Secure" and "HttpOnly" cookies |
| 263 |
|
| 264 |
= 1.4.0 = |
| 265 |
*Release Date - 5th July, 2017* |
| 266 |
|
| 267 |
* Added support of Apache (via htaccess) inclusion method |
| 268 |
|
| 269 |
= 1.3.0 = |
| 270 |
*Release Date - 3rd June, 2017* |
| 271 |
|
| 272 |
* Added support of Content-Security-Policy header |
| 273 |
* Added dashboard |
| 274 |
|
| 275 |
= 1.2.0 = |
| 276 |
*Release Date - 28th April, 2017* |
| 277 |
|
| 278 |
* Added support of Referrer-Policy header |
| 279 |
|
| 280 |
= 1.1.2 = |
| 281 |
*Release Date - 13th February, 2017* |
| 282 |
|
| 283 |
* Added support of 'preload' directive to HSTS header |
| 284 |
|
| 285 |
= 1.1.1 = |
| 286 |
*Release Date - 8th November, 2016* |
| 287 |
|
| 288 |
* Fixed typo in the X-Frame-Options header |
| 289 |
|
| 290 |
= 1.1.0 = |
| 291 |
*Release Date - 20th May, 2016* |
| 292 |
|
| 293 |
* Added support of P3P header |
| 294 |
|
| 295 |
= 1.0.0 = |
| 296 |
*Release Date - 10th May, 2016* |
| 297 |
|
| 298 |
* Initial version |
| 299 |
|
