shasha310

<p>Harden your web applications.</p>
<p>HTTP header fields are components of the header section of request and response messages. The headers define the operating parameters of an HTTP transaction.</p>
<p>Securing HTTP headers will improve the resilience of your web application against many common attacks including those that are on the OWASP top 10 list.</p>
<p>Securing headers can also improve your SEO rank and in addition to preventing websites from being marked as dangerous by browsers and antivirus applications.</p>
<p>Protect sensitive user information and be compliant with privacy regulations. Defend users from stealing private data by protecting website cookies. Use the proper directive such as “secure”, “httponly” and “samesite”, all of those will be applied automatically by “Secure HTTP Headers” plugin.</p>
<p>Secure HTTP Headers will automatically analyze any website and will build up secure headers directives, by the latest best practice.</p>
<p>In addition, Secure HTTP Headers offers fully configurable options, apply or skip any header directive as needed.</p>
<p>Install and activate Secure HTTP Headers with full confidence, the deactivation of this plugin will return your website header directives to their original state.</p>
<h3>Main plugin functionality</h3>
<ol>
<li>
<p>HTTP Strict Transport Security – helps to protect websites against man-in-the-middle attacks and cookie hijacking</p>
</li>
<li>
<p>X-Frame-Options – helps to protect users against ClickJacking attacks</p>
</li>
<li>
<p>X-Content-Type-Options  – helps to prevent the browser from MIME-sniffing</p>
</li>
<li>
<p>Referrer-Policy – helps to control how much referrer information should be included with requests</p>
</li>
<li>
<p>Clear-Site-Data – helps to ensure that data is deleted from the browser if the user logs out</p>
</li>
<li>
<p>X-Download-Options – helps to control how IE 8 will handle downloaded HTML files</p>
</li>
<li>
<p>Access-Control-Allow-Origin – helps to ensure whether the response can be shared with requesting code from the given origin</p>
</li>
<li>
<p>Cross-Origin-Embedder-Policy – helps to prevent a document from loading any cross-origin resources that don’t explicitly grant the document permission</p>
</li>
<li>
<p>Permissions-Policy – helps to allow and deny the use of browser features in its own frame, and in content within any iframe elements in the document</p>
</li>
<li>
<p>Cross-Origin-Opener-Policy – helps to protect websites against a set of cross-origin attacks dubbed XS-Leaks</p>
</li>
<li>
<p>Cross-Origin-Resource-Policy – helps to protect websites against speculative side-channel attacks, like Spectre, as well as Cross-Site Script Inclusion attacks</p>
</li>
<li>
<p>X-Permitted-Cross-Domain-Policies – helps to control how cross-domain requests from Flash and PDF documents are handled</p>
</li>
<li>
<p>Cookie Http-Only flag – helps to protect websites against Cross-Site Scripting, or XSS attacks</p>
</li>
<li>
<p>Cookie Secure flag – helps to ensure that cookie is sent over a secure connection</p>
</li>
<li>
<p>Cookie Samesite Lax flag – helps to protect websites against CSRF and XSSI attacks</p>
</li>
<li>
<p>Expect-CT – helps to prevent the use of misissued certificates for a website. Note: The Expect-CT will likely become obsolete in June 2021</p>
</li>
</ol>
<h3>What are the optional extras?</h3>
<p>Magnisec is offering “Secure HTTP Headers enhanced”</p>
<p>A plugin that contains, in addition, an engine that watches and builds in any website changes a CSP – Content Security Policy that is best practice and recommended by all professional securities experts, that mitigate XSS -Cross site Scripting, one of the most common and destructive attacks.</p>
<p>Price: 50$ /year for a domain.</p>
<p>More details and installation <a href="https://magnisec.com" rel="nofollow ugc">here</a></p>


Secure HTTP Headers

Secure HTTP headers - Essential, and easy.

Brendigo

<p>BrenWP Client Safe Mode helps you troubleshoot safely and reduce risk when handing a WordPress site to clients or non-technical users.</p>
<p>Safe Mode is <em>per-user</em>: it applies only to the currently logged-in user who enabled it. Visitors and other users are not affected.</p>
<h4>Safe Mode (per-user) can optionally</h4>
<ul>
<li>Block access to risky wp-admin screens (plugin/theme management, core updates, Site Health, and update actions)</li>
<li>Disable file modifications (plugin/theme installs, updates, editors)</li>
<li>Optionally block update/install capabilities (prevents running updates/installs even via alternative flows)</li>
<li>Optionally block destructive capabilities (prevents deleting plugins/themes while Safe Mode is enabled)</li>
<li>Optionally disable the built-in plugin/theme editors (capability-based) while Safe Mode is enabled</li>
<li>Hide update notices</li>
<li>Trim selected admin bar nodes (Updates / Comments / New Content)</li>
<li>Auto-disable after a configurable number of minutes (optional)</li>
</ul>
<h4>Client restrictions (role-based + optional user targeting) can</h4>
<ul>
<li>Optionally target a specific user account (in addition to roles)</li>
<li>Hide risky menus</li>
<li>Block direct access to sensitive wp-admin screens</li>
<li>Disable file modifications</li>
<li>Hide update notices</li>
<li>Optionally limit the Media Library to a user’s own uploads (privacy on multi-author sites)</li>
<li>Optionally hide common Dashboard widgets for restricted roles (UI cleanup)</li>
<li>Optionally hide the Screen Options dropdown (independent toggle)</li>
<li>Optionally hide the Admin Bar on the front end for restricted roles</li>
<li>Optionally block Customizer access (customize.php)</li>
<li>Optionally block Users screens (Users list/Add/Edit) even if the broader screen blocklist is disabled</li>
<li>Optionally block Tools screens (Tools/Import/Export) even if the broader screen blocklist is disabled</li>
<li>Optionally lock profile email/password changes for restricted roles (prevents self-service account takeover)</li>
<li>Optionally show a dismissible 2FA security reminder notice (notice only)</li>
<li>Optionally hide the Admin Bar on the front end for restricted roles</li>
</ul>
<h4>General hardening (site-wide, optional)</h4>
<ul>
<li>Disable XML-RPC</li>
<li>Disable the built-in plugin/theme editors for all users (capability-based)</li>
<li>Optional settings export download (admin-only) via a nonce-protected endpoint (default OFF)</li>
</ul>
<p>Administrators are never restricted by client restrictions. On multisite, super-admins are also excluded.</p>
<h4>Privacy</h4>
<p>This plugin does not send data to external services. It performs <strong>no tracking, telemetry, analytics, or “phone-home” requests</strong>.</p>
<h4>Data stored on your site</h4>
<p>The plugin stores the minimum required data to provide Safe Mode and optional auditing:</p>
<ul>
<li><strong>Options (Settings)</strong>: stored in the <code>brenwp_csm_options</code> option (site option). This contains your configured settings.</li>
<li><strong>Activity log (optional)</strong>: stored in the <code>brenwp_csm_activity_log</code> option <strong>only if Activity logging is enabled</strong>. This log is bounded by <strong>Max entries</strong> and can optionally be pruned by age (Retention days).</li>
<li><strong>Operational options</strong>: internal housekeeping options such as <code>brenwp_csm_last_settings_change</code> and a short-lived lock key used to avoid concurrent log writes.</li>
<li><strong>User meta (Safe Mode)</strong>:
<ul>
<li><code>brenwp_csm_safe_mode</code> (on/off flag for a user)</li>
<li><code>brenwp_csm_safe_mode_until</code> (optional expiry timestamp if auto-off is enabled)</li>
</ul>
</li>
</ul>
<h4>Data minimization and retention</h4>
<ul>
<li>Activity logging is <strong>disabled by default</strong>.</li>
<li>The activity log does <strong>not</strong> store IP addresses and attempts to redact likely secrets from context values.</li>
<li>Retention controls:
<ul>
<li><strong>Max entries</strong> caps log size.</li>
<li><strong>Retention days</strong> can automatically prune older entries (0 = disabled).</li>
<li>The <strong>Clear log</strong> action removes all log entries immediately (admin-only, nonce protected).</li>
</ul>
</li>
</ul>
<h4>Privacy tools</h4>
<p>The plugin:<br />
* Adds suggested text to the Privacy Policy Guide (Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Privacy)<br />
* Registers a personal data exporter and eraser for the Safe Mode user meta</p>
<h4>Data deletion</h4>
<p>On uninstall (delete), the plugin removes its options, optional log option, Safe Mode user meta, and (best-effort) the optional <code>bren_client</code> role if it was created by the plugin.</p>
<h3>Security</h3>
<p>This plugin follows WordPress hardening best practices:</p>
<ul>
<li><strong>CSRF protection</strong>: all state-changing actions use <strong>POST</strong> and require a <strong>WordPress nonce</strong>.</li>
<li><strong>Authorization</strong>: privileged admin actions are gated by <strong>capability checks</strong> (<code>manage_options</code> by default, filterable).</li>
<li><strong>XSS defense</strong>: user-controlled data is sanitized on input and escaped on output.</li>
<li><strong>No remote requests</strong>: the plugin does not make outbound HTTP requests.</li>
<li><strong>Data minimization</strong>: the activity log is bounded, does not store IP addresses, and redacts likely secrets in log context values.</li>
</ul>
<p>Assumptions and scope:</p>
<ul>
<li>The plugin enforces policies inside WordPress; it does not replace server/WAF hardening.</li>
<li>Safe Mode is <strong>per-user</strong> and does not modify the site’s active plugins/themes list.</li>
</ul>
<h3>Troubleshooting</h3>
<h4>I don’t see the Safe Mode toggle in the admin bar</h4>
<ul>
<li>Confirm the WordPress admin bar is enabled for your account.</li>
<li>Confirm <strong>Enforcement</strong> is enabled in the plugin settings.</li>
<li>Confirm your role is included in <strong>Who can toggle Safe Mode</strong> (or you are an administrator / multisite super-admin).</li>
</ul>
<h4>My profile email/password cannot be changed</h4>
<p>If <strong>Restrictions <span aria-hidden="true" class="wp-exclude-emoji">→</span> Lock profile email/password</strong> is enabled and your account is restricted, you will not be able to change your own email or password. Contact an administrator.</p>
<h4>XML-RPC stopped working</h4>
<p>If you rely on legacy services that require XML-RPC (some old mobile apps / integrations), disable <strong>General <span aria-hidden="true" class="wp-exclude-emoji">→</span> Disable XML-RPC</strong>.</p>
<h4>I get redirected with an “Access blocked” notice</h4>
<p>A configured policy blocked a sensitive admin screen. Review:<br />
* <strong>Restrictions <span aria-hidden="true" class="wp-exclude-emoji">→</span> Block direct screen access</strong> (for restricted roles)<br />
* <strong>Safe Mode <span aria-hidden="true" class="wp-exclude-emoji">→</span> Block risky admin screens</strong> (for your account if Safe Mode is enabled)</p>
<h4>Safe Mode is enabled but I want to turn it off</h4>
<ul>
<li>Use the <strong>Safe Mode</strong> tab to toggle it off.</li>
<li>If auto-off is enabled, it will disable automatically after the configured time window.</li>
<li>If Enforcement is OFF, the UI provides a <strong>Clear stored Safe Mode</strong> button to remove the stored flag.</li>
</ul>
<h3>Developer Hooks</h3>
<p>Filters:<br />
* <code>brenwp_csm_required_cap</code> — change the capability required to manage this plugin (default: <code>manage_options</code>).<br />
* <code>brenwp_csm_presets</code> — customize Dashboard presets (label/description/patch arrays).<br />
* <code>brenwp_csm_create_client_role</code> — return <code>false</code> to prevent creating the <code>bren_client</code> role on activation.<br />
* <code>brenwp_csm_client_role_caps</code> — customize capabilities assigned to the <code>bren_client</code> role on activation.<br />
* <code>brenwp_csm_remove_client_role_on_uninstall</code> — return <code>false</code> to keep the <code>bren_client</code> role during uninstall cleanup.</p>


BrenWP Client Safe Mode

Per-user Safe Mode plus role-based client restrictions for safer troubleshooting and cleaner client handoff.

Secure HTTP Headers vs BrenWP Client Safe Mode