360 Orbit Header Security
| 开发者 | joergliwa |
|---|---|
| 更新时间 | 2026年10月7日 17:18 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Strict-Transport-Security (HSTS)
- X-Frame-Options and CSP frame-ancestors (clickjacking protection, even without a full CSP)
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Cross-Origin-Opener-Policy / Cross-Origin-Resource-Policy
- Cookie hardening: adds missing Secure and SameSite attributes to all cookies the website sends
- Optional 301 redirect from HTTP to HTTPS
- Content Security Policy (CSP), including a report-only mode for a low-risk start.
- Learning mode: collects everything the CSP would block for a configurable period and only switches to enforcing once no finding is left unreviewed.
- A scanner that automatically detects the external services your site needs (scripts, styles, images, fonts, iframes) and presents them for approval, including bulk approve/block.
- Separate header configuration for the backend (wp-admin); WordPress's own services are allowed automatically.
- One address for your site: redirects the other spelling (with or without "www.") to the address set in WordPress.
- Option to load http:// sub-resources over https (upgrade-insecure-requests) as part of the Content Security Policy.
- Automatic update notifications directly in the WordPress backend.
安装:
- Install the plugin under Plugins > Add New (search for "360 Orbit Header Security"), or upload the ZIP under Plugins > Add New > Upload Plugin.
- Activate the plugin.
- In the Header Security menu, click "Run quickstart" or configure the headers individually.
常见问题:
Can I accidentally break my website with this?
The quickstart defaults are deliberately cautious (for example, X-Frame-Options: SAMEORIGIN instead of DENY, so the WordPress Customizer keeps working). The Content Security Policy (Pro) starts in report-only mode by default, which does not block anything and only reports.
Do I have to use a Content Security Policy?
No. CSP is optional and only available in the Pro version anyway. The basic headers of the free version work independently of it.
Who is liable in case of damage?
This plugin is provided without any warranty ("as is"). The developer accepts no liability for data loss or damage resulting from the use of the plugin (for example, from an overly restrictive header configuration). Before using it, you are strongly advised to create a full backup and to test changes in report-only mode first.
Does the plugin change files or contact other servers?
By default it only sends headers from PHP. Optionally you can switch on the ".htaccess mirror": the plugin then writes its own marked block into your .htaccess (so the headers also reach cached pages) and tests your homepage with a request to your own site, rolling back automatically if the site stops responding. While that block exists, the plugin also keeps a small guard file in wp-content/mu-plugins/ that removes the block should the plugin folder ever be deleted without deactivating it; deactivating or deleting the plugin removes both. No data is sent to any other server.
Does it work on multisite?
The headers work on every site. Because the .htaccess file is shared by the whole network, only a super admin can use the ".htaccess mirror" on multisite.
Which languages is the backend available in?
The backend follows the language set in WordPress. Translations are provided through translate.wordpress.org and you are welcome to contribute one for your language.
更新日志:
- Fix: the 360 WP Orbit overview page could show the wrong name, link and description for one of the plugins (a duplicated list key). The list is now correct.
- New (Pro): redirect the other spelling of your address (with or without "www.") to the address set in WordPress, with a 301 redirect.
- New (Pro): option to add the upgrade-insecure-requests directive to the Content Security Policy.
- Internal: texts of the Orbit overview page are now translatable instead of hard-coded German.
- Changed: the update screen in wp-admin now shows the plugin icon and banner (Pro only; the free version contains no updater).
- Changed: the introduction on the settings page and in the help tab now describes only what the free version does (the frontend headers); the text about the Content Security Policy and the backend belongs to Pro.
- Changed: corrected plugin logo -- lettering and symbol are now centered, the orbit is a closed ring.
- First release on WordPress.org, including the results of an internal security review.
- Fix: the optional HTTPS redirect no longer drops encoded characters (umlauts) from the address, no longer doubles the path on installations in a subdirectory and no longer redirects form submissions.
- Fix: the .htaccess mirror and its guard file are now only created while the mirror is switched on, and on multisite only a super admin can use it. The quickstart updates the mirror as well.
- Fix: the one-time data migration from older versions now only touches this plugin's own, exactly named data and no longer clears the whole object cache.
- Fix: values written to the .htaccess block are escaped completely; the homepage test honors the https_local_ssl_verify filter.
- Fix: a Content-Security-Policy header set by another plugin is no longer overwritten by the frame-ancestors header.
- Fix: uninstalling removes the data of every site on multisite and the guard file.
- Changed: the German translation is now also used for Austrian, Swiss and formal German.