SeaSP Community Edition vs Security Headers & Caching

SeaSP Community Edition is an automated Content Security Policy Manager. SeaSP allows you to create, configure, manage, and deploy a Content Security Policy for your site. The WordPress SeaSP Community Edition plugin catalogs the domains that appear on your site. Categorize and filter out unwanted domains. Add a layer of WordPress security site from Magecart and other cross-site scripting attacks to keep your WordPress site safe. SeaSP installs a strict non-blocking CSP to collect violation data and provide a violation report. Violation data flows into the WordPress database as a PHP option within the plugin options schema. Violations can be approved by domains and categorized by directives (CSS, fonts, images, JS, etc.). You can also approve base domains and subdomains. The SeaSP UI helps users by explaining what each directive does, and how to use them to create a CSP. After configuring the domain and directive settings switch the CSP to blocking mode. Once the CSP goes into blocking mode, the site’s protected from any unrecognized code. SeaSP Community Edition helps secure your site. Upgrade Notice for 1.4 only When you install this version you will need to rebuild your CSP Usage Once installed, a strict non-blocking report-only CSP is implemented on your site. Visit each page of your site to collect CSP violations. Visit the Current Violations page of the plugin to review domains that have violated a directive in the CSP. Review each of the domains carefully and check for misspellings of common domains like adobee.com instead of adobe.com as this is a common way hackers inject content into your site. If you feel confident that the domain belongs on your site and it should be serving the file type stated, click the toggle to approve the domain to include it in the CSP. If you want to allow subdomains of that domain to be able to serve that type of content, click the Manage subdomains button to view the subdomains. After this process, you might still see CSP violations regarding inline scripts, inline styles, blobs, or data. To allow these this type of content in the community version you must navigate to the Directive Settings page, find the offending directive, then toggle the appropriate option. For convenience, each option has a tooltip explaining what it allows in your CSP. Walk Through A walk through video can be found on YouTube here. Contributing Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change. This project has been tested on WordPress up to version 5.8 on both single and multi-site instances. The project can be found on github. This project is sponsored by Blue Triangle. Third Party Libraries We use Bootstrap for the UI of our plugin to make the interface clean and simple. Bootstraps license can be found here We use bootstrap toggle because simple check boxes can be confusing and we wanted our CSP mangers UI to feel easy. This code was developed for The New York Times by Min Hur and is licensed under MIT License GNU Opt In usage data collection As of version 1.5 users will be able to opt-in for data collection to help us determine how many people are using our plugin and what features we should be working on in future version. This can be managed in the Usage Data Settings page. We collect and send the following data: 1. wordpress version 2. wordpress debug mode 3. wordpress multisite 4. the base url that the plugin is on ex; www.bluetriangle.com This data is only accessible to the Blue Triangle organization and will be used to determine our user base and feature planning.

Security Headers & Caching is a comprehensive WordPress plugin that helps protect your website by implementing essential HTTP security headers and optimizing performance through intelligent caching mechanisms. Compatible with all hosting providers including Aruba, SiteGround, Bluehost, and more. Key Features Easy Configuration – Simple admin interface to enable/disable security headers Multiple Security Headers – Comprehensive security header support Smart Caching – Configurable cache duration for better performance Universal Compatibility – Works with all hosting providers No Conflicts – Compatible with popular security and caching plugins Translation Ready – Full internationalization support Security Headers Included X-Powered-By – Removes server technology information to prevent targeted attacks Content-Security-Policy (CSP) – Controls which resources can be loaded to prevent XSS attacks Strict-Transport-Security (HSTS) – Forces HTTPS connections for enhanced security X-XSS-Protection – Enables XSS filtering in older browsers X-Frame-Options – Prevents clickjacking attacks by controlling iframe embedding X-Content-Type-Options – Prevents MIME type sniffing Referrer-Policy – Controls how much referrer information is shared Permissions-Policy – Controls browser features and APIs Caching Features Configurable cache duration (seconds) Automatic cache headers management Compatible with CDN services No conflict with existing cache plugins Why Security Headers Matter Security headers are HTTP response headers that tell your browser how to behave when handling your website’s content. They help protect against: Cross-Site Scripting (XSS) attacks Clickjacking attempts Code injection attacks MIME type sniffing Protocol downgrade attacks And much more… Developer Friendly The plugin provides filters for developers to customize headers: shc_security_headers – Filter to modify security headers array Test Your Security After installing and configuring the plugin, test your site’s security at: * Security Headers * Mozilla Observatory Privacy This plugin does not collect, store, or transmit any user data. It only modifies HTTP response headers sent by your server. Developer Documentation Filters shc_security_headers Modify the security headers before they are sent. add_filter( 'shc_security_headers', function( $headers ) { // Add custom header $headers['X-Custom-Header'] = 'custom-value'; // Modify existing header $headers['X-Frame-Options'] = 'DENY'; return $headers; } ); Constants SHC_VERSION – Plugin version number SHC_PLUGIN_DIR – Plugin directory path SHC_PLUGIN_URL – Plugin directory URL SHC_PLUGIN_BASENAME – Plugin basename Support For support, feature requests, or bug reports, please visit: * Plugin Website Credits Developed by Studio Be4 – Web Design & Development Agency License This plugin is licensed under the GPLv2 or later.