Host Header Injection Fix vs Send Images to RSS

👉 Enables custom headers for WP email notifications 👉 Also provides a “set it and forget it” security fix for WP < 5.5 👉 Uses only 50KB of code, so super lightweight, fast, and effective Important As of WordPress 5.5, this plugin no longer is necessary to fix the host-header security issue reported in Ticket #25239 finally is fixed, and mentioned in this post WordPress 5.5 Beta 4. Thank You WordPress devs! Is this plugin still useful? Yes, it enables you to choose the “From”, “Name”, and “Return-Path” headers for all WP notification emails. And for versions of WordPress less than 5.5, this plugin continues to fix the host-header injection security issue. Features This simple plugin does three things: Sets custom From, Name, and Return-Path for WP notifications Fixes a security vulnerability in WordPress versions < 5.5 Fixes a bug where invalid email addresses may be generated (in WordPress versions < 5.5) Choose from the following options: Use WordPress defaults (insecure for WP < 5.5) Use “Email Address” from WP General Settings Use a custom name and address Plus there is an option to use the specified From address as the Return-Path header. Why? The security issue fixed by this plugin has been known about since way back in WordPress version 2.3. There has been some talk about fixing, but nothing has been implemented. While the issue does not affect all sites, it does affect a good percentage of them, including some of my own projects. So, not wanting to get hacked, I decided to write my own solution. Hopefully this issue gets fixed in a future version of WordPress, and this plugin will become unnecessary. As a bonus, setting an explicit From address resolves a long-standing bug whereby an invalid email address is generated under the following conditions: A “From” address is not set, And the $_SERVER['SERVER_NAME'] is empty So by explicitly setting a “From” address, we prevent this bug from happening. Security Issue What is the security issue addressed by this plugin? Follows is a quick summary. To learn more in-depth, check out the resources linked in the next section. WP uses $_SERVER['SERVER_NAME'] to set the “From” header in email notifications This includes sensitive email notifications like password resets and user registration In some cases, an attacker could modify the “From” header and intercept the email Using the intercepted email, an attacker could gain access to your site and wreak havoc More Infos This security vulnerability is well-known and has been around for a looong time. To learn more, check out these articles: WP Core Trac Ticket Exploit Box Info Exploit Database Privacy This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way. Host Header Injection Fix is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thank you! 🙂

Send Images to RSS bridges the gap between large websites and small emails, by replacing images in your feed with smaller, email friendly images, and attempting to add markup which email clients can handle. Between larger monitors, retina screens, and better image optimization, the images we serve up on our websites are larger than they’ve ever been. RSS to email services such as MailChimp, however, are constrained to what email clients can display, which is small, small, small. And although it’s possible to try to style images with a max-width in your emails, not all clients will honor it (I’m looking at you, Outlook). Send Images to RSS makes it easy to create beautiful, email friendly RSS campaigns, with minimal setup required, regardless of your feed setup. Full Text RSS Feeds If your site’s RSS feed is set to Full Text, this plugin makes sure your emails look more like your website: Replace overly large images with email friendly size images. Convert galleries from thumbnails to full width images. Add email friendly styling/alignment to your images. Summary Text Feeds If you’ve used Summaries as your RSS feed settings, this plugin has not been for you. Until now. As of 3.0.0, Send Images to RSS brings the awesome to you, too. Here’s the magic for your Summary feed: Add the post’s featured image to your excerpt. Choose the size and alignment. If no featured image is set, the plugin will use the first image uploaded to the post. Set a custom length for your RSS summary/excerpt. Pick the number of words you want your summary to have, and the plugin will aim for that, but with the added bonus of making sure the final sentence is complete. If you add a manual excerpt to your post, because you like to have full control, the plugin will properly use that instead. Automatically add a custom “read more” link to the end of every post summary, to keep your feed pointed back to your site. Known (non)Issues This plugin should work with any theme. Some themes and plugins do modify the feed for their own purposes. Where possible, I’ve tried to account for them: For summary feeds, the Yoast SEO RSS link is removed (the full text feed and front end output are not changed). For summary feeds, the excerpt filter added by the Woo Canvas theme is removed (the full text feed and front end output are not changed). For summary feeds, this plugin will replace the image settings for Display Featured Image for Genesis for versions 2.3.0 and later (because this plugin is smarter). If you’re using Display Featured Image for Genesis 2.2.2 or lower, this plugin will concede graciously. But you should update, please. For full text feeds, this plugin will not duplicate featured images if they are being added by Display Featured Image for Genesis–you will want to disable that feature in Display Featured Image for Genesis. NOTE: it is up to you to check that your feed output is still working, especially in your email system of choice, once it’s installed. I’ve attempted to set it up to handle XHTML or HTML5, and function even if your feed is wonky, but please double check, and let me know if you have issues, and if so, what specifically they are. Props Special thanks to Gretchen Louise for her summary feed contributions. Spanish translation offered by Web Hosting Hub