{"id":387038,"date":"2026-10-15T09:25:51","date_gmt":"2026-10-15T09:25:51","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/gmcfuerte-security-headers\/"},"modified":"2026-10-15T09:25:40","modified_gmt":"2026-10-15T09:25:40","slug":"gmcfuerte-security-headers","status":"publish","type":"plugin","link":"https:\/\/me.wordpress.org\/plugins\/gmcfuerte-security-headers\/","author":10408525,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.1","stable_tag":"1.0.1","tested":"7.1.3","requires":"6.3","requires_php":"8.1","requires_plugins":null,"header_name":"Gmcfuerte Security Headers","header_author":"gmcfuerte","header_description":"Adds the recommended security headers with safe presets, never sends a header twice, and explains the headers your site really sends with a read-only self-check.","assets_banners_color":"","last_updated":"2026-10-15 09:25:40","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/fuerteventuratv.net\/en\/cms\/gmcfuerte-security-headers","header_author_uri":"https:\/\/fuerteventuratv.net\/en\/cms\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":44,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.1":{"tag":"1.0.1","author":"gmcfuerte","date":"2026-10-15 09:25:40","revision":3748054}},"upgrade_notice":{"1.0.1":"<p>Uses automatic translation loading and WordPress.org language packs. Security headers and saved settings are unchanged.<\/p>","1.0.0":"<p>First release.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[34310,203031,246736,153786,56634],"plugin_category":[],"plugin_contributors":[277384],"plugin_business_model":[],"class_list":["post-387038","plugin","type-plugin","status-publish","hentry","plugin_tags-hsts","plugin_tags-permissions-policy","plugin_tags-referrer-policy","plugin_tags-security-headers","plugin_tags-x-frame-options","plugin_contributors-gmcfuerte","plugin_committers-gmcfuerte"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/gmcfuerte-security-headers.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Gmcfuerte Security Headers adds the security headers that scanners and hosting audits expect, without editing the\nweb server configuration, and tells you in plain words what each header does.<\/p>\n\n<p>What it sends (each one can be switched off):<\/p>\n\n<ul>\n<li>X-Content-Type-Options: nosniff<\/li>\n<li>X-Frame-Options: SAMEORIGIN (or DENY)<\/li>\n<li>Referrer-Policy: strict-origin-when-cross-origin (or strict-origin, same-origin, no-referrer)<\/li>\n<li>Permissions-Policy: Basic preset (camera, microphone and location off, also in embedded maps and video) or Strict preset<\/li>\n<li>Strict-Transport-Security (HSTS): off by default, opt-in with a clear warning, max-age from 5 minutes to 1 year, optional includeSubDomains; sent on HTTPS requests only<\/li>\n<li>Removes the X-Powered-By header that reveals your PHP version<\/li>\n<\/ul>\n\n<p>Values come from short lists of safe choices, so a typing mistake cannot break your site.<\/p>\n\n<p>Never twice: a header that WordPress, another plugin or your .htaccess file already sets keeps its value. The plugin\nonly adds what is missing, and the settings page names the headers it leaves to your .htaccess file.<\/p>\n\n<p>Self-check: one click reads the headers your home page really sends (including those set by the server, the\n.htaccess file or other plugins) and shows, for each one, its status (OK, missing, sent twice, weak, reveals\ninformation), the value received and what it means.<\/p>\n\n<p>The plugin stores one option with your choices. It sets no cookies and does not collect personal data.<\/p>\n\n<p>A Pro edition adds a Content-Security-Policy with a Report-Only rollout and script nonces, free-form policy values,\nHSTS preload with reverse-proxy checks and 404 responses for version-revealing files. This free plugin works on its\nown and does not need it. If both are active, this plugin sends nothing and says so on its settings page. The Pro\nsends headers only with a valid licence, so run the self-check to see what your site really sends. Settings do\nnot carry over.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin does not connect to any external service. The self-check, only when an administrator clicks\n\"Run the self-check\", makes one HTTP request from your server to your own home page (plus at most three redirects\non the same site) to read its response headers. No data is sent to third parties.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>gmcfuerte-security-headers<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install the ZIP from Plugins -&gt; Add New -&gt; Upload Plugin.<\/li>\n<li>Activate the plugin through the Plugins screen.<\/li>\n<li>Open Settings -&gt; Gmcfuerte Security Headers, check the choices and click Save Changes.<\/li>\n<li>Click \"Run the self-check\" to see what your home page sends.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20it%20break%20my%20site%3F\"><h3>Will it break my site?<\/h3><\/dt>\n<dd><p>The defaults suit most sites, with two points to check:<\/p>\n\n<ul>\n<li>The Basic Permissions-Policy, on by default, turns off camera, microphone and location for your pages and for\neverything embedded in them. Maps that locate the visitor (including the \"my location\" button of an embedded map),\nvideo calls, voice input and QR scanners stop working. If your site uses any of them, set Permissions-Policy to Off.<\/li>\n<li>X-Frame-Options stops other sites from showing your pages in a frame: switch it off if another site of yours\nembeds these pages.<\/li>\n<\/ul>\n\n<p>The Strict Permissions-Policy preset also blocks browser payment buttons (Apple Pay, Google Pay): do not use Strict on\nshops that use them.<\/p><\/dd>\n<dt id=\"why%20does%20the%20self-check%20still%20show%20a%20header%20as%20missing%3F\"><h3>Why does the self-check still show a header as missing?<\/h3><\/dt>\n<dd><p>Headers are added by PHP. A page cache that serves stored pages without running PHP, or a CDN, may drop them. Some\nheaders may also be left to your .htaccess file (the settings page lists them): if your server ignores the\n.htaccess file or lacks mod_headers, they are not sent. While the Pro edition is active this plugin sends nothing,\nand the Pro sends headers only with a valid licence.<\/p><\/dd>\n<dt id=\"why%20is%20a%20header%20%22sent%20twice%22%3F\"><h3>Why is a header \"sent twice\"?<\/h3><\/dt>\n<dd><p>Two layers set it, for example the server configuration and a plugin. This plugin never adds a header that is\nalready present in PHP or declared in your .htaccess file, but it cannot see headers that the server or a proxy\nadds on its own. Keep one source.<\/p><\/dd>\n<dt id=\"should%20i%20turn%20on%20hsts%3F\"><h3>Should I turn on HSTS?<\/h3><\/dt>\n<dd><p>Only when every page and file of your site works over HTTPS. Browsers that receive HSTS refuse plain HTTP for your\ndomain for the whole max-age, and turning the setting off does not undo that. Start with 5 minutes, then raise it.<\/p><\/dd>\n<dt id=\"does%20it%20add%20a%20content-security-policy%3F\"><h3>Does it add a Content-Security-Policy?<\/h3><\/dt>\n<dd><p>No. A Content-Security-Policy has to be tuned to the scripts and services each site uses. The self-check tells you\nwhether your site sends one.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Use WordPress.org language packs and automatic translation loading. Translation source files are maintained separately for translate.wordpress.org; they are no longer bundled in the plugin ZIP.<\/li>\n<li>Security header behaviour and saved settings are unchanged. English is used when a language pack is not installed.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release: nosniff, X-Frame-Options, Referrer-Policy and Permissions-Policy presets, opt-in HSTS, X-Powered-By removal, gap-filling rule (never sent twice), read-only self-check, translations in Italian, Spanish and French.<\/li>\n<\/ul>","raw_excerpt":"Recommended security headers with safe presets, never sent twice, plus a read-only self-check that explains what your site really sends.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/387038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=387038"}],"author":[{"embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/gmcfuerte"}],"wp:attachment":[{"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=387038"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=387038"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=387038"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=387038"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=387038"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/me.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=387038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}