Nubivio Security Headers, security.txt & NIS2 Compliance for Healthcare
| 开发者 | nubivio |
|---|---|
| 更新时间 | 2026年7月2日 17:29 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Set the security headers that matter, publish a self-renewing security.txt (RFC 9116), and check your site against NIS2, the EU Cyber Resilience Act (CRA), GDPR and NEN 7510, all from one settings page. Built for general practitioners, psychologists and other healthcare professionals who need a defensible security baseline without a consultant.
The defaults are safe to ship on a live site, and the plugin is built to move your score on the internet.nl test in the right direction. The compliance features are optional and read-only: they verify and document what you already have, and never change your hardening.
Why healthcare sites use this
- One click to a strong header set and a valid security.txt, the two things the internet.nl test and most security reviews check first.
- An optional Compliance tab that turns those headers and your security.txt into evidence, mapped to NIS2 Art. 21, CRA Art. 14 and GDPR clauses.
- A compliance score with a plain-language breakdown, so you know where you stand and what to fix next.
- Available in English and Dutch.
- Strict-Transport-Security (HSTS) with configurable max-age, includeSubDomains and preload
- Content-Security-Policy with an internet.nl compliant baseline and a Report-Only test mode
- Referrer-Policy with the internet.nl rating shown per value
- X-Content-Type-Options (nosniff)
- X-Frame-Options
- Permissions-Policy
- Active removal of the deprecated X-XSS-Protection and Expect-CT headers
- Writes /.well-known/security.txt and serves it dynamically when the docroot is read-only
- Refreshes the Expires field automatically so it never lapses and stays under one year
- Fields for Contact, Encryption, Policy, Acknowledgments, Hiring (careers), CSAF, Preferred-Languages and Canonical
- Paste your PGP public key and the plugin hosts it at /.well-known/openpgp-key.txt and links it as Encryption automatically
- A free-text message to researchers and an optional signature line
- CRLF line endings and a valid Canonical URL, exactly as the internet.nl test expects
- A Compliance tab with a single compliance score and a red / amber / green band
- CRA plugin readiness: checks each active plugin against the WordPress.org directory for update currency, compatibility and abandonment
- GDPR checks: detects third-party scripts, forms and consent tooling, and cross-references your Content-Security-Policy
- NIS2 Art. 21 signals: encryption in transit, MFA, backups, WAF, activity logging and auto-updates
- Site health checks: security.txt validity, live header verification, WordPress and PHP currency, TLS, debug mode, XML-RPC and REST user exposure
- Live verification that your configured security headers are actually being sent, not just set
- Security headers and security.txt shown as compliance evidence, mapped to the relevant NIS2, CRA and GDPR clauses
- One-click documents generated from your own settings: a Vulnerability Disclosure Policy, a CycloneDX SBOM, an EU and NEN 7510 conformity declaration, and a printable compliance report
- Block submissions from one or more email domains, with a custom error message
- The section only appears when Gravity Forms is active
安装:
- Upload the plugin folder to /wp-content/plugins/, or install the ZIP via Plugins, Add New, Upload Plugin.
- Activate the plugin.
- Open Settings, Nubivio Security.
- Set a Contact value under security.txt.
- To pass the internet.nl Content-Security-Policy check, enable CSP, test in Report-Only, add the domains your site needs, then turn Report-Only off to enforce.
屏幕截图:
常见问题:
Will activating the plugin break my site?
No. HSTS, nosniff, X-Frame-Options, Referrer-Policy and Permissions-Policy are safe defaults. Content-Security-Policy is off by default because a strict policy needs tuning per site.
How do I get a fully green internet.nl result?
Enable and enforce a Content-Security-Policy that fits your site, set Referrer-Policy to no-referrer or same-origin, and set a Contact for security.txt. IPv6, CAA, the TLS hash and DANE are out of scope and must be fixed at your host or DNS.
Can I publish a PGP key?
Yes. Paste your ASCII-armored public key in the security.txt section. The plugin hosts it at /.well-known/openpgp-key.txt and references it from security.txt as the Encryption field automatically.
Does this make me NIS2, CRA, GDPR or NEN 7510 compliant?
No single plugin can. It covers the public web hardening part (transport security, browser protections and a vulnerability disclosure contact), verifies it live, and generates starting-point documents such as a Vulnerability Disclosure Policy, an SBOM and a conformity declaration. It is a useful building block and an evidence tool, not a full compliance programme or a certification.
Is the Compliance tab safe to use?
Yes. It is optional and read-only. Scanning only reads your site and public WordPress.org data; it never changes your settings or hardening. If you never open the tab, nothing about your site changes.
Is Gravity Forms required?
No. The header and security.txt features work on any site. The form section only appears when Gravity Forms is active.
更新日志:
2.2.1
- Listing and documentation refresh: clearer description covering the NIS2, CRA and security.txt features, and two new screenshots of the Compliance tab. No code changes.
- New Compliance tab: CRA, GDPR and NIS2 scanning plus site health checks
- Live verification that configured security headers are actually sent
- security.txt and headers now scored and mapped to CRA / NIS2 / GDPR clauses
- Compliance score with per-framework breakdown
- Generators: Vulnerability Disclosure Policy, CycloneDX SBOM, EU/NEN 7510 conformity declaration
- Printable compliance report (browser print to PDF, no added dependencies)
- Existing header and security.txt hardening unchanged
- Added plugin icon, banner and a settings page screenshot for the WordPress.org listing
- All filesystem reads, writes and deletes now go through the WP_Filesystem API and wp_delete_file()
- Renamed the plugin to Nubivio Healthcare Security Hardening
- Admin CSS and JavaScript are now enqueued instead of printed inline
- The security.txt and PGP key files are now located via get_home_path() so they land at the public site root on subdirectory and custom installs
- Internal option, cron and nonce keys renamed to the new namespace
- Settings page for all options
- internet.nl compliant Content-Security-Policy baseline with Report-Only mode
- Self-renewing security.txt with CRLF line endings and an expiry kept under one year
- Hosted PGP public key, linked from security.txt as Encryption
- Extra security.txt fields: Hiring, CSAF, researcher message and an optional signature
- Removal of deprecated X-XSS-Protection and Expect-CT headers
- Gravity Forms email-domain blocking, shown only when Gravity Forms is active