توضیحات
Best all-in-one WordPress security plugin, uses HTTP & HSTS response headers to avoid vulnerabilities: XSS, injection, clickjacking. Force HTTP/HTTPS.
تغییرات این نسخه
5.3.5
This release brings back server-level header coverage (cached pages and static files) that 5.3.4 lost, without reintroducing duplicate headers.
Fixed: On full-page caches and static files (CSS, JS, images) the security headers were missing after 5.3.4, because headers were emitted only through PHP and those responses never run PHP. External scanners could report the headers as gone. The plugin now writes the headers to .htaccess again on Apache and LiteSpeed, so the web server applies them to every response.
Added: Automatic de-duplication is available but is turned off by default in this version. The plugin writes the header to .htaccess and PHP keeps sending it too. On Apache the .htaccess directive replaces, so you still get a single copy. On LiteSpeed .htaccess appends instead, so if a header shows up twice, set that header to “Server only” under “Advanced: per-header delivery” to keep the server’s copy and drop the plugin’s. When automatic de-duplication is enabled, the plugin confirms – by measuring its own live responses – that the server is already sending a header before it stops sending its own copy; if that proof is missing, stale, or uncertain it keeps sending. It always errs toward sending, never toward a missing header.
Added: A “Run check now” button on the settings page (Delivery diagnostics) shows which web server was detected, whether the .htaccess block is in place, the backend port the plugin learned (or that it has not learned one yet), the exact
This release brings back server-level header coverage (cached pages and static files) that 5.3.4 lost, without reintroducing duplicate headers.
Fixed: On full-page caches and static files (CSS, JS, images) the security headers were missing after 5.3.4, because headers were emitted only through PHP and those responses never run PHP. External scanners could report the headers as gone. The plugin now writes the headers to .htaccess again on Apache and LiteSpeed, so the web server applies them to every response.
Added: Automatic de-duplication is available but is turned off by default in this version. The plugin writes the header to .htaccess and PHP keeps sending it too. On Apache the .htaccess directive replaces, so you still get a single copy. On LiteSpeed .htaccess appends instead, so if a header shows up twice, set that header to “Server only” under “Advanced: per-header delivery” to keep the server’s copy and drop the plugin’s. When automatic de-duplication is enabled, the plugin confirms – by measuring its own live responses – that the server is already sending a header before it stops sending its own copy; if that proof is missing, stale, or uncertain it keeps sending. It always errs toward sending, never toward a missing header.
Added: A “Run check now” button on the settings page (Delivery diagnostics) shows which web server was detected, whether the .htaccess block is in place, the backend port the plugin learned (or that it has not learned one yet), the exact