Giter Club home page Giter Club logo

http-headers's Introduction

HTTP Headers

A WordPress plugin that allows you to easily control HTTP response headers of your website.

Donate link: https://www.paypal.me/Dimitar81

Requires at least: 3.2

Tested up to: 6.3.1

Requires PHP: 5.3

Stable tag: 1.19.1

License: GPLv2 or later

Description

HTTP Headers gives your control over the http headers returned by your blog or website.

Headers supported by HTTP Headers includes:

  • Access-Control-Allow-Origin
  • Access-Control-Allow-Credentials
  • Access-Control-Max-Age
  • Access-Control-Allow-Methods
  • Access-Control-Allow-Headers
  • Access-Control-Expose-Headers
  • Age
  • Content-Security-Policy
  • Content-Security-Policy-Report-Only
  • Cache-Control
  • Clear-Site-Data
  • Connection
  • Content-Encoding
  • Content-Type
  • Cross-Origin-Embedder-Policy
  • Cross-Origin-Opener-Policy
  • Cross-Origin-Resource-Policy
  • Expect-CT
  • Expires
  • Feature-Policy
  • NEL
  • Permissions-Policy
  • Pragma
  • P3P
  • Referrer-Policy
  • Report-To
  • Strict-Transport-Security
  • Timing-Allow-Origin
  • Vary
  • WWW-Authenticate
  • X-Content-Type-Options
  • X-DNS-Prefetch-Control
  • X-Download-Options
  • X-Frame-Options
  • X-Permitted-Cross-Domain-Policies
  • X-Powered-By
  • X-Robots-Tag
  • X-UA-Compatible
  • X-XSS-Protection

Installation

Upload the HTTP Headers plugin to your blog. Then activate it.

That's all.

Frequently Asked Questions

Why to use this plugin?

Nowadays security of your social data at the web is essential. This plugin helps you to improve your website overall security.

Who use these headers?

These HTTP headers are being used in production services by popular websites as Facebook, Google+, Twitter, LinkedIn, YouTube, Yahoo, Amazon, Instagram, Pinterest.

Upgrade Notice

Updates are on they way, so stay tuned at @DimitarIvanov

Changelog

1.19.1

Release Date - 2nd September, 2023

  • Added "clientHints" directive to "Clear-Site-Data" header
  • Added "credentialless" directive to "Cross-Origin-Embedder-Policy" header

1.19.0

Release Date - 7th July, 2023

  • Fixed: SSRF vulnerability by an Admin user
  • Fixed: XSS vulnerability by an Admin user

1.18.11

Release Date - 11th June, 2023

  • Fixed: Remote Code Execution by an Admin user

1.18.10

Release Date - 28th May, 2023

  • Fixed: Remote Code Execution by an Admin user
  • Removed: Import/Export functions

1.18.9

Release Date - 23rd April, 2023

  • Fixed: Remote Code Execution by an Admin user

1.18.8

Release Date - 17th April, 2023

  • Fixed: SQL Injection by an Admin user
  • Fixed: Remote Code Execution by an Admin user
  • Few PHP 8.x compatible fixes

1.18.7

Release Date - 24th January, 2023

  • Fix CSP default value

1.18.6

Release Date - 22nd January, 2023

  • PHP 8 compatibility changes

1.18.5

Release Date - 30th April, 2021

  • Configurable paths to files who store passwords for basic/digest auth
  • Fixed issue with plugin activation, due missing file

1.18.4

Release Date - 30th April, 2021

  • Initial value of X-Robots-Tag fixed

1.18.3

Release Date - 30th April, 2021

  • Added "X-Robots-Tag" header
  • Added "interest-cohort", "layout-animations", "legacy-image-formats", "oversized-images", and "wake-lock" directive to "Permissions-Policy" header
  • Added "cross-origin" value to "Cross-Origin-Resource-Policy" header
  • Added "navigate-to" and "prefetch-src" directives to "Content-Security-Policy" header

1.18.2

Release Date - 24th April, 2021

  • Configurable paths to .htaccess and .user.ini files

1.18.1

Release Date - 29th October, 2020

  • Added "allow-downloads" and "allow-top-navigation-by-user-activation" to "sandbox" directive, part of CSP

1.18.0

Release Date - 20th September, 2020

  • Added "Permissions-Policy" header
  • Fixed "Cookie Security"

1.17.0

Release Date - 26th July, 2020

  • Added "Cross-Origin-Embedder-Policy" header
  • Added "Cross-Origin-Opener-Policy" header

1.16.1

Release Date - 23rd July, 2020

  • Fixed JS/CSS versioning

1.16.0

Release Date - 23rd July, 2020

  • Added the "NEL" header
  • Fixed the "Report-To" header

1.15.2

Release Date - 18th June, 2020

  • Fixed a PHP Notice at "Expires" page
  • Fixed comments in .user.ini file

1.15.1

Release Date - 9th May, 2020

  • Fixed the "Access-Control-Allow-Origin" header

1.15.0

Release Date - 26th January, 2020

  • Added the "Cross-Origin-Resource-Policy" header
  • Removed the "Public-Key-Pins" header

1.14.2

Release Date - 25th November, 2019

  • CORS headers updated (added "Vary: Origin")

1.14.1

Release Date - 15th September, 2019

  • Simple filtering was replaced with Dynamic filtering

1.14.0

Release Date - 1st September, 2019

  • Added the "Content-Type" header
  • Fixed the "Access-Control-Allow-Credentials" header
  • Improvement to "Access-Control-Allow-Headers" header
  • Improvement to "Access-Control-Allow-Methods" header
  • Improvement to "Access-Control-Expose-Headers" header
  • Improvement to "Cache-Control" header
  • Improvement to "Vary" header

1.13.4

Release Date - 14th July, 2019

  • Added the "always" condition to Header (unset) directive
  • Fixed the "import" function
  • Fixed the "Access-Control-Allow-Origin" header

1.13.3

Release Date - 16th June, 2019

  • Bugfix in "WWW-Authenticate" header
  • Added support of Apache 2.4

1.13.2

Release Date - 13th June, 2019

  • Bugfix in "Content-Encoding" header
  • Bugfix in "Vary" header

1.13.1

Release Date - 8th June, 2019

  • Added Brotli compression

1.13.0

Release Date - 7th June, 2019

  • Added "SameSite" to Cookie Security
  • Fixed import/export function
  • Code refactoring

1.12.2

Release Date - 5th April, 2019

  • UI improvement for Content-Security-Policy
  • Fix for Access-Control-Allow-Headers
  • Fix for Access-Control-Allow-Origin
  • Fix for Feature-Policy

1.12.1

Release Date - 9th January, 2019

  • Remove direct calls to cURL

1.12.0

Release Date - 5th January, 2019

  • Better handling of activate/deactivate functions

1.11.0

Release Date - 9th December, 2018

  • Added support of "Clear-Site-Data" header

1.10.5

Release Date - 6th November, 2018

  • Hotfix: parallel work with third-party plugins

1.10.4

Release Date - 30th September, 2018

  • Support of following Server APIs: CGI, FastCGI, PHP-FPM
  • Error handling improvement

1.10.3

Release Date - 8th August, 2018

  • HSTS improvement
  • CORS improvement

1.10.2

Release Date - 31st July, 2018

  • Export feature bug-fixed

1.10.1

Release Date - 18th July, 2018

  • Feature-Policy header update: new features added

1.10.0

Release Date - 17th July, 2018

  • Added support of "Feature-Policy" header

1.9.5

Release Date - 12th July, 2018

  • CORS bugfix

1.9.4

Release Date - 13th January, 2018

  • In-plugin security improvement

1.9.3

Release Date - 10th January, 2018

  • Bug fix

1.9.2

Release Date - 4th January, 2018

  • Security improvements

1.9.1

Release Date - 27th December, 2017

  • Updated translations

1.9.0

Release Date - 23th December, 2017

  • Added support of "Report-To" header
  • Added support of translations
  • Added support of Import/Export
  • Updated "Content-Security-Policy" header (added directives: object-src, frame-src, worker-src, manifest-src, base-uri, report-to)
  • Updated "WWW-Authenticate" header (support multiple users)
  • Updated "Access-Control" headers (added list of origins)

1.8.0

Release Date - 31st August, 2017

  • Added support of "Timing-Allow-Origin" header
  • Added support of "X-Download-Options" header
  • Added support of "X-DNS-Prefetch-Control" header
  • Added support of "X-Permitted-Cross-Domain-Policies" header
  • Added support of Custom headers

1.7.1

Release Date - 18th August, 2017

  • PHP notice bugfixed

1.7.0

Release Date - 15th August, 2017

  • Added support of "Content-Security-Policy-Report-Only" header
  • Added support of "Public-Key-Pins-Report-Only" header
  • Added "1; report=" directive to the "X-XSS-Protection" header
  • Added "Inspect headers" tool
  • UI bugfixes

1.6.0

Release Date - 5th August, 2017

  • Added support of "Expect-CT" header

1.5.0

Release Date - 30th July, 2017

  • Added support of "Age" header
  • Added support of "Cache-Control" header
  • Added support of "Connection" header
  • Added support of "Content-Encoding" header
  • Added support of "Expires" header
  • Added support of "Pragma" header
  • Added support of "Vary" header
  • Added support of "WWW-Authenticate" header
  • Added support of "X-Powered-By" header
  • Added support of "Secure" and "HttpOnly" cookies

1.4.0

Release Date - 5th July, 2017

  • Added support of Apache (via htaccess) inclusion method

1.3.0

Release Date - 3rd June, 2017

  • Added support of Content-Security-Policy header
  • Added dashboard

1.2.0

Release Date - 28th April, 2017

  • Added support of Referrer-Policy header

1.1.2

Release Date - 13th February, 2017

  • Added support of 'preload' directive to HSTS header

1.1.1

Release Date - 8th November, 2016

  • Fixed typo in the X-Frame-Options header

1.1.0

Release Date - 20th May, 2016

  • Added support of P3P header

1.0.0

Release Date - 10th May, 2016

  • Initial version

http-headers's People

Contributors

riverside avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar

Forkers

rublutv fedeisas timnolte apiatin weszty jakubstanior

http-headers's Issues

A basic CSP setting for beginners

Hi

Thanks a lot for your WordPress HTTP Headers plugin.

Can you please give us a basic setting for the CSP implentation ?
if I follow the recomendations from https://infosec.mozilla.org/guidelines/web_security#content-security-policy I block many things on a basic WP site.

for instance the /wp-admin/plugin-install.php page doesn't display the extension image anymore.

Since your plugin is for WP can you please give this basic settings for the Content Security Policy please?
thanks

HTTP Headers does not work for requests targeting a blog's rss feed

Hello,

I tried your plugin and it seems as it doesn't support altering requests that are sent to a WordPress blog's rss feed.

The usual url is https://some-blog.com/feed. Here is my example feed -> https://quickcoder.org/feed

Although I activated the "Access-Control-Allow-Origin" header, it doesn't work for the feed page. I still get a CORS error when using a custom app to access the content. Other pages on my blog work fine though with this app.

If you need further information, I'd be happy to supply those. Thanks!

Configured Report-To response header is malformed

The Report-To header returned by the plugin is not correctly formed.

A sample header as returned looks like the following (pretty for readability):

{
    "url": "https://example.com/reports",
    "group": "default",
    "max-age": 86400
}

According to Section 3.1 of the specification the JSON object should have:

  • An optional group (string) member
  • An optional include_subdomains (boolean) member
  • A required max_age (number; positive integer) member
  • A required endpoints (array) member

The url member being returned is not expected at the top-level of the JSON object, but instead should be included as a required member of each array element in the endpoints member. Each array element may also include optional priority and weight members, but this is not supported yet by the plugin.

Taking the earlier returned response the correct format would be (pretty for readability):

{
    "group": "default",
    "max_age": 86400,
    "endpoints": [
        {
            "url": "https://example.com/reports"
        }
    ]
}

The UI for configuring this header probably needs to be reworked a bit as it has the following related issues:

  • A group contains one or more endpoints (as array elements). If multiple entries are provided with the same group, they should be added as separate array elements to the endpoints member of the same underlying group.
  • The include_subdomains field is specific to a group and not a url. If two URLs are configured with the same group but different values for include_subdomains, this cannot be represented according to the specification.
  • The same issue applies to max_age, which is specific to a group and not a url.

Add support for the NEL response header

Great work on a fantastic plugin! Makes managing the ever-increasing number of important HTTP headers much easier.

One header the plugin doesn't currently support is the NEL (Network Error Logging) header. This header works in conjunction with the Report-To header to enable browsers to report network events such as failed requests. It's a relatively simple header, and given your existing support for Report-To I expect would be relatively simple to implement. What are your thoughts?

Some background information:

Plugin Vulnerability

Hello!

We've been alerted of a vulnerability involving SQL injection on the plugin regarding version 1.18.9

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/http-headers/http-headers-1189-authenticatedadministrator-sql-injection

A few users have reported this on the Plugin support:
https://wordpress.org/support/topic/vulnerability-65/
https://wordpress.org/support/topic/http-headers-1-18-9-authenticatedadministrator-sql-injection/

Thanks for your attention!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.