bluetriangle

<p>SeaSP Community Edition is an automated <strong>Content Security Policy Manager</strong>. SeaSP allows you to create, configure, manage, and deploy a Content Security Policy for your site.</p>
<p>The WordPress SeaSP Community Edition plugin catalogs the domains that appear on your site. Categorize and filter out unwanted domains. Add a layer of WordPress security site from Magecart and other cross-site scripting attacks to keep your WordPress site safe.</p>
<p>SeaSP installs a strict non-blocking CSP to collect violation data and provide a violation report. Violation data flows into the WordPress database as a PHP option within the plugin options schema. Violations can be approved by domains and categorized by directives (CSS, fonts, images, JS, etc.). You can also approve base domains and subdomains. The SeaSP UI helps users by explaining what each directive does, and how to use them to create a CSP.</p>
<p>After configuring the domain and directive settings switch the CSP to blocking mode. Once the CSP goes into blocking mode, the site’s protected from any unrecognized code. SeaSP Community Edition helps secure your site.</p>
<h3>Upgrade Notice for 1.4 only</h3>
<ul>
<li>When you install this version you will need to rebuild your CSP</li>
</ul>
<h3>Usage</h3>
<p>Once installed, a strict non-blocking report-only CSP is implemented on your site. Visit each page of your site to collect CSP violations.<br />
Visit the Current Violations page of the plugin to review domains that have violated a directive in the CSP.<br />
Review each of the domains carefully and check for misspellings of common domains like adobee.com instead of adobe.com as this is a common way hackers inject content into your site.<br />
If you feel confident that the domain belongs on your site and it should be serving the file type stated, click the toggle to approve the domain to include it in the CSP.<br />
If you want to allow subdomains of that domain to be able to serve that type of content, click the Manage subdomains button to view the subdomains.<br />
After this process, you might still see CSP violations regarding inline scripts, inline styles, blobs, or data.<br />
To allow these this type of content in the community version you must navigate to the Directive Settings page, find the offending directive, then toggle the appropriate option.<br />
For convenience, each option has a tooltip explaining what it allows in your CSP.</p>
<h3>Walk Through</h3>
<p>A walk through video can be found on YouTube <a href="https://youtu.be/XdJNh6LEKJw" rel="nofollow ugc">here</a>.</p>
<p><span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/XdJNh6LEKJw?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p>
<h3>Contributing</h3>
<p>Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.<br />
This project has been tested on WordPress up to version 5.8 on both single and multi-site instances.<br />
The project can be found on <a href="https://github.com/blue-triangle-tech/sea-sp-community-edition" rel="nofollow ugc">github</a>.<br />
This project is sponsored by <a href="www.bluetriangle.com" rel="nofollow ugc">Blue Triangle</a>.</p>
<h3>Third Party Libraries</h3>
<p>We use <a href="https://getbootstrap.com/" rel="nofollow ugc">Bootstrap</a> for the UI of our plugin to make the interface clean and simple.<br />
Bootstraps license can be found <a href="https://github.com/twbs/bootstrap/blob/main/LICENSE" rel="nofollow ugc">here</a></p>
<p>We use <a href="https://www.bootstraptoggle.com/" rel="nofollow ugc">bootstrap toggle</a> because simple check boxes can be confusing and we wanted our CSP mangers UI to feel easy. This code was developed for The New York Times by <a href="https://github.com/minhur" rel="nofollow ugc">Min Hur</a> and is licensed under <a href="https://opensource.org/licenses/MIT" rel="nofollow ugc">MIT</a></p>
<h3>License</h3>
<p><a href="https://choosealicense.com/licenses/gpl-3.0/" rel="nofollow ugc">GNU</a></p>
<h3>Opt In usage data collection</h3>
<p>As of version 1.5 users will be able to opt-in for data collection to help us determine how many people are using our plugin and what features we should be working on in future version. This can be managed in the Usage Data Settings page. We collect and send the following data:<br />
1. wordpress version<br />
2. wordpress debug mode<br />
3. wordpress multisite<br />
4. the base url that the plugin is on ex; www.bluetriangle.com<br />
This data is only accessible to the Blue Triangle organization and will be used to determine our user base and feature planning.</p>


SeaSP Community Edition

SeaSP Community Edition is an automated Content Security Policy Manager. SeaSP allows you to create, configure, manage, and deploy a Content Security  …

Nick C

<p>The GNU Terry Pratchett plugin transmits an “X-Clacks-Overhead” header reading, “GNU Terry Pratchett” so that Terry’s name is whispered forevermore in the Internet’s “overhead”.</p>
<p>In Pratchett’s “Going Postal”, workers who die in the line of duty have their names transmitted up and down the Discworld’s telegraph system as a tribute.</p>
<p>This plugin makes it easy for WordPress users to do the same for Terry Pratchett, without having to modify their server configuration.</p>
<h4>The GNU Terry Pratchett headers</h4>
<p>The plugin adds the GNU Terry Pratchett header in two ways:</p>
<ol>
<li>As an HTTP header (if you don’t use a WordPress page caching plugin).</li>
<li>As a meta tag in your HTML with the http-equiv attribute.</li>
</ol>
<h4>Settings</h4>
<p>The text sent in HTTP headers and meta tags is “GNU Terry Pratchett” by default.</p>
<p>Change this by visiting Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> GNU Terry Pratchett in your WordPress admin area and editing the “X-Clacks-Overhead header” field.</p>
<p>This option lets you honor other people you would like to remember by making them a small part of your site’s content forever.</p>
<h4>Checking the HTTP header is sent</h4>
<p>There are several ways to check that the HTTP header is appearing for your site:</p>
<ol>
<li>With your terminal (<code>curl -I example.com</code>)</li>
<li>With Chrome’s Network tab.</li>
<li>With the <a href="https://chrome.google.com/webstore/detail/clacks-overhead-gnu-terry/lnndfmobdoobjfcalkmfojmanbeoegab" rel="nofollow ugc">Clacks Overhead</a> Chrome plugin or the <a href="https://addons.mozilla.org/en-US/firefox/addon/gnu_terry_pratchett/" rel="nofollow ugc">GNU Terry Pratchett Firefox extension</a>.</li>
<li>Using the <a href="http://tools.seobook.com/server-header-checker/" rel="nofollow ugc">Server Header Checker</a>.</li>
</ol>
<p>Note that the HTTP header is not sent if you use a page caching plugin. To send the HTTP header and continue to use a caching plugin, add the header at the server level. See http://www.gnuterrypratchett.com/ for options.</p>
<h4>Checking the meta tag is added</h4>
<p>You can check that the meta tag is visible by viewing your site’s HTML source and searching for “GNU Terry Pratchett”.</p>
<p>The <a href="https://chrome.google.com/webstore/detail/clacks-overhead-gnu-terry/lnndfmobdoobjfcalkmfojmanbeoegab" rel="nofollow ugc">Clacks Overhead plugin</a> for Chrome and the <a href="https://addons.mozilla.org/en-US/firefox/addon/gnu_terry_pratchett/" rel="nofollow ugc">GNU Terry Pratchett extension</a> for Firefox both light up when they detect the HTML meta tag or HTTP header.</p>
<h4>Credits and contributions</h4>
<p>Inspired by <a href="http://www.reddit.com/r/bestof/comments/2yyop7/rdiscworld_redditors_with_web_servers_start/" rel="nofollow ugc">this reddit post</a>, <a href="http://boingboing.net/2015/03/15/sending-terry-pratchett-home-w.html" rel="nofollow ugc">boingboing’s report</a>, and the <a href="http://www.gnuterrypratchett.com/" rel="nofollow ugc">GNU Terry Pratchett</a> website.</p>
<p>Contributions welcome at the <a href="https://github.com/nickcernis/gnu-terry-pratchett" rel="nofollow ugc">GitHub repo</a>.</p>


GNU Terry Pratchett

Add an X-Clacks-Overhead header with “GNU Terry Pratchett” to all non-admin pages.

SeaSP Community Edition vs GNU Terry Pratchett