HTTP Headers

Deskripsi

HTTP Headers gives your control over the http headers returned by your blog or website.

Headers supported by HTTP Headers includes:

  • Access-Control-Allow-Origin
  • Access-Control-Allow-Credentials
  • Access-Control-Max-Age
  • Access-Control-Allow-Methods
  • Access-Control-Allow-Headers
  • Access-Control-Expose-Headers
  • Age
  • Content-Security-Policy
  • Content-Security-Policy-Report-Only
  • Cache-Control
  • Clear-Site-Data
  • Connection
  • Content-Encoding
  • Content-Type
  • Cross-Origin-Embedder-Policy
  • Cross-Origin-Opener-Policy
  • Cross-Origin-Resource-Policy
  • Expect-CT
  • Expires
  • Feature-Policy
  • NEL
  • Permissions-Policy
  • Pragma
  • ~~Public-Key-Pins~~
  • ~~Public-Key-Pins-Report-Only~~
  • P3P
  • Referrer-Policy
  • Report-To
  • Strict-Transport-Security
  • Timing-Allow-Origin
  • Vary
  • WWW-Authenticate
  • X-Content-Type-Options
  • X-DNS-Prefetch-Control
  • X-Download-Options
  • X-Frame-Options
  • X-Permitted-Cross-Domain-Policies
  • X-Powered-By
  • X-UA-Compatible
  • X-XSS-Protection

The getting started tutorial describes a typical configuration of this plugin.

Tangkapan Layar

  • This screenshot shows up the dashboard with categories of the supported headers.
  • This screenshot shows up the headers of a chosen category and their current values.
  • This screenshot shows up the settings page where you can adjust the security headers.
  • This screenshot shows up the response headers returned by the web server.

Instalasi

Upload the HTTP Headers plugin to your blog. Then activate it.

That’s all.

Tanya Jawab

Why to use this plugin?

Nowadays security of your social data at the web is essential. This plugin helps you to improve your website overall security.

Who use these headers?

These HTTP headers are being used in production services by popular websites as Facebook, Google+, Twitter, LinkedIn, YouTube, Yahoo, Amazon, Instagram, Pinterest.

Ulasan

19 Februari 2021
Ce modules semble très complet, mais il faut être un Pro de la sécurité pour l'utiliser. Si vous n'y connaissez rien et que vous voulez un module simple qui assure la sécurité, celui n'est pas pour vous. Sans compter qu'aussi bien le module que le site qui fournit les explications d'aide ne sont disponibles qu'en anglais, ce qui rend encore plus difficile le paramétrage. Je mets donc 3 étoiles, pour le nombre de paramètres que le module permet de gérer, car j'en enlève une pour la langue en anglais uniquement, et une autre pour la présentation et la navigation interne dans module, qui est certes claire, mais qui oblige à des aller-retour incessant entre le paramétrage d'un fonctionnalité et le retour au tableau des réglage pour passer au paramètre suivant. J'aurai plutôt attendu un bouton un bouton qui permettent d'activer la fonctionnalité et que les réglages possibles pour le paramètre apparaissent comme dans une FAQ, avec un menu accordéon (désactivé / fermé quand la fonctionnalité est désactivée et qui s'active lorsqu'on pousse un bouton pour activer la fonctionnalité, ouvrant ainsi l'accordéon). Mais je pense qu'il y a ce qu'il faut pour en faire le meilleur module du genre.
5 Februari 2021
Thank you for the great plugin. If we made the recommended presets for wordpress-the price would not be there! At least the settings for wordpress which is out of the box, this is really not enough!
19 Januari 2021
Amazing ... Amazing .... Amazing
31 Desember 2020
I thank you for your contribution to the WordPress community. This plugin is really nice, and makes setting headers for security and other concerns easy and transparent. Bravo!
Baca semua 48 ulasan

Kontributor & Pengembang

“HTTP Headers” adalah perangkat lunak open source. Berikut ini mereka yang sudah berkontribusi pada plugin ini.

Kontributor

“HTTP Headers” telah diterjemahkan dalam 1 bahasa. Terima kasih kepada para penerjemah untuk kontribusi-nya.

Terjemahkan “HTTP Headers” dalam bahasa Anda.

Tertarik mengembangkan?

Lihat kode, periksa repositori SVN , atau mendaftar ke log pengembangan melalui RSS.

Log Perubahan

1.18.1

Release Date – 29th October, 2020

  • Added “allow-downloads” and “allow-top-navigation-by-user-activation” to “sandbox” directive, part of CSP

1.18.0

Release Date – 20th September, 2020

  • Added “Permissions-Policy” header
  • Fixed “Cookie Security”

1.17.0

Release Date – 26th July, 2020

  • Added “Cross-Origin-Embedder-Policy” header
  • Added “Cross-Origin-Opener-Policy” header

1.16.1

Release Date – 23rd July, 2020

  • Fixed JS/CSS versioning

1.16.0

Release Date – 23rd July, 2020

  • Added the “NEL” header
  • Fixed the “Report-To” header

1.15.2

Release Date – 18th June, 2020

  • Fixed a PHP Notice at “Expires” page
  • Fixed comments in .user.ini file

1.15.1

Release Date – 9th May, 2020

  • Fixed the “Access-Control-Allow-Origin” header

1.15.0

Release Date – 26th January, 2020

  • Added the “Cross-Origin-Resource-Policy” header
  • Removed the “Public-Key-Pins” header

1.14.2

Release Date – 25th November, 2019

  • CORS headers updated (added “Vary: Origin”)

1.14.1

Release Date – 15th September, 2019

  • Simple filtering was replaced with Dynamic filtering

1.14.0

Release Date – 1st September, 2019

  • Added the “Content-Type” header
  • Fixed the “Access-Control-Allow-Credentials” header
  • Improvement to “Access-Control-Allow-Headers” header
  • Improvement to “Access-Control-Allow-Methods” header
  • Improvement to “Access-Control-Expose-Headers” header
  • Improvement to “Cache-Control” header
  • Improvement to “Vary” header

1.13.4

Release Date – 14th July, 2019

  • Added the “always” condition to Header (unset) directive
  • Fixed the “import” function
  • Fixed the “Access-Control-Allow-Origin” header

1.13.3

Release Date – 16th June, 2019

  • Bugfix in “WWW-Authenticate” header
  • Added support of Apache 2.4

1.13.2

Release Date – 13th June, 2019

  • Bugfix in “Content-Encoding” header
  • Bugfix in “Vary” header

1.13.1

Release Date – 8th June, 2019

  • Added Brotli compression

1.13.0

Release Date – 7th June, 2019

  • Added “SameSite” to Cookie Security
  • Fixed import/export function
  • Code refactoring

1.12.2

Release Date – 5th April, 2019

  • UI improvement for Content-Security-Policy
  • Fix for Access-Control-Allow-Headers
  • Fix for Access-Control-Allow-Origin
  • Fix for Feature-Policy

1.12.1

Release Date – 9th January, 2019

  • Remove direct calls to cURL

1.12.0

Release Date – 5th January, 2019

  • Better handling of activate/deactivate functions

1.11.0

Release Date – 9th December, 2018

  • Added support of “Clear-Site-Data” header

1.10.5

Release Date – 6th November, 2018

  • Hotfix: parallel work with third-party plugins

1.10.4

Release Date – 30th September, 2018

  • Support of following Server APIs: CGI, FastCGI, PHP-FPM
  • Error handling improvement

1.10.3

Release Date – 8th August, 2018

  • HSTS improvement
  • CORS improvement

1.10.2

Release Date – 31st July, 2018

  • Export feature bug-fixed

1.10.1

Release Date – 18th July, 2018

  • Feature-Policy header update: new features added

1.10.0

Release Date – 17th July, 2018

  • Added support of “Feature-Policy” header

1.9.5

Release Date – 12th July, 2018

  • CORS bugfix

1.9.4

Release Date – 13th January, 2018

  • In-plugin security improvement

1.9.3

Release Date – 10th January, 2018

  • Bug fix

1.9.2

Release Date – 4th January, 2018

  • Security improvements

1.9.1

Release Date – 27th December, 2017

  • Updated translations

1.9.0

Release Date – 23th December, 2017

  • Added support of “Report-To” header
  • Added support of translations
  • Added support of Import/Export
  • Updated “Content-Security-Policy” header (added directives: object-src, frame-src, worker-src, manifest-src, base-uri, report-to)
  • Updated “WWW-Authenticate” header (support multiple users)
  • Updated “Access-Control” headers (added list of origins)

1.8.0

Release Date – 31st August, 2017

  • Added support of “Timing-Allow-Origin” header
  • Added support of “X-Download-Options” header
  • Added support of “X-DNS-Prefetch-Control” header
  • Added support of “X-Permitted-Cross-Domain-Policies” header
  • Added support of Custom headers

1.7.1

Release Date – 18th August, 2017

  • PHP notice bugfixed

1.7.0

Release Date – 15th August, 2017

  • Added support of “Content-Security-Policy-Report-Only” header
  • Added support of “Public-Key-Pins-Report-Only” header
  • Added “1; report=” directive to the “X-XSS-Protection” header
  • Added “Inspect headers” tool
  • UI bugfixes

1.6.0

Release Date – 5th August, 2017

  • Added support of “Expect-CT” header

1.5.0

Release Date – 30th July, 2017

  • Added support of “Age” header
  • Added support of “Cache-Control” header
  • Added support of “Connection” header
  • Added support of “Content-Encoding” header
  • Added support of “Expires” header
  • Added support of “Pragma” header
  • Added support of “Vary” header
  • Added support of “WWW-Authenticate” header
  • Added support of “X-Powered-By” header
  • Added support of “Secure” and “HttpOnly” cookies

1.4.0

Release Date – 5th July, 2017

  • Added support of Apache (via htaccess) inclusion method

1.3.0

Release Date – 3rd June, 2017

  • Added support of Content-Security-Policy header
  • Added dashboard

1.2.0

Release Date – 28th April, 2017

  • Added support of Referrer-Policy header

1.1.2

Release Date – 13th February, 2017

  • Added support of ‘preload’ directive to HSTS header

1.1.1

Release Date – 8th November, 2016

  • Fixed typo in the X-Frame-Options header

1.1.0

Release Date – 20th May, 2016

  • Added support of P3P header

1.0.0

Release Date – 10th May, 2016

  • Initial version