Linux 软件免费装

在这里免费安装WordPress以及其他软件

Banner图

EssentialHeaders

开发者 alexhedstrom
更新时间 2026年8月28日 12:49
PHP版本: 7.4 及以上
WordPress版本: 7.1
版权: GPLv2 or later
版权网址: 版权信息

标签

security http headers csp hsts

下载

1.0.1 1.0.2 1.0.0

详情介绍:

EssentialHeaders is a focused WordPress plugin that attaches the HTTP security headers browsers expect, so protection is not left to chance or buried in server config. Under Settings → EssentialHeaders you get three tabs: Headers covered: Safer headers are enabled with sensible defaults. CSP starts off with a strict baseline, so you can test and allow only the sources your site needs before enabling it. Headers apply to public site responses (pages, feeds, and the login screen)—not wp-admin, AJAX, REST, GraphQL, or XML-RPC. HSTS is only sent over HTTPS. Default HSTS uses max-age only; add includeSubDomains yourself when every subdomain is ready.

安装:

  1. Upload the essentialheaders folder to the /wp-content/plugins/ directory.
  2. Activate the plugin through the Plugins menu in WordPress.
  3. Open Settings → EssentialHeaders to review and configure headers.

常见问题:

Will this break my site?

The default set is conservative. Content-Security-Policy is off by default because a strict CSP can block scripts or styles your theme needs. Enable CSP when you are ready to tune it.

Does HSTS work on HTTP?

No. Strict-Transport-Security is only sent when the visitor reaches the site over HTTPS.

Does the login screen get these headers?

Yes. The login screen is treated as a public response. wp-admin, AJAX, REST, GraphQL, and XML-RPC are excluded, so dashboards and APIs are not broken by a strict CSP.

Does this change site content?

No. The plugin only stores its own options and manages HTTP response headers on public responses.

Can X-Powered-By always be removed?

EssentialHeaders removes PHP- and WordPress-managed instances at the latest applicable WordPress header hook. Another callback running afterward, a reverse proxy, or a web server can add the header again; remove it at that layer as well.

更新日志:

1.0.2 1.0.1 1.0.0