Error message after update to v:

Resolved

(@fitnsexy)

After the last update I get the following error message again in the health status of my page.

Your website does not send all recommended security headers.

    Upgrade Insecure Requests
    X-XSS protection
    X-Content Type Options
    Referrer-Policy
    Expect-CT
    X-Frame-Options
    Permissions-Policy

In my htaccess I have integrated the following code that also worked before …

# BEGIN Security Header
<IfModule mod_headers.c>
  Header set X-Frame-Options "DENY"
  Header set X-XSS-Protection "1; mode=block"
  Header set X-Content-Type-Options "nosniff"
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header set Referrer-Policy "no-referrer"
  Header always set Content-Security-Policy "upgrade-insecure-requests"
  Header always set Expect-CT "max-age=7776000, enforce"
  Header set Permissions-Policy "accelerometer=()‚ autoplay=(self), camera=(), encrypted-media=(), fullscreen=(), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), usb=(), interest-cohort=()"
</IfModule>
# END Security Header

Viewing 10 replies - 1 through 10 (of 10 total)

Plugin Contributor Rogier Lankhorst
(@rogierlankhorst)

4 years, 6 months ago

Hi @fitnsexy what is your domain so I can take a look?

Plugin Contributor Rogier Lankhorst
(@rogierlankhorst)

4 years, 6 months ago

@fitnsexy since the last update the plugin checks for the actual headers using a CURL request. This should result in a more accurate check, unless the CURL request fails. In that case the plugin will fallback on the htaccess check.

The reason for this change is that this will work on NGINX and other servers as well.

Thread Starter Chigolo
(@fitnsexy)

4 years, 6 months ago

Hi @rogierlankhorst,

thx for your reply. The link to my page is https://www.sportkopfhoerer-vergleich.de/.

Plugin Author Mark
(@markwolters)

4 years, 6 months ago

Hi @fitnsexy,

your site does not return the security headers correctly, see https://securityheaders.com/?q=https%3A%2F%2Fwww.sportkopfhoerer-vergleich.de%2F&followRedirects=on

It could be the mod_headers.c module is not enabled on your server. Could you verify with your hosting provider if this is the case?

Thread Starter Chigolo
(@fitnsexy)

4 years, 6 months ago

Thx @markwolters for the info. I’ve contacted my hoster and will get back to you soon.

Thread Starter Chigolo
(@fitnsexy)

4 years, 6 months ago

Here is the answer from my hoster @markwolters:

mod_headers is available. Just be careful that some headers are overwritten by PHP scripts. Therefore he has to add his desired header to all PHP files (there are plugins for e.g. WordPress)
Plugin Author Mark
(@markwolters)

4 years, 6 months ago
Hi @fitnsexy,

that sounds like your hosting provider is overriding the security headers and requires you to add them to all PHP file before they work correctly. That would explain why the regular .htaccess method is not working on your site. You might be able to achieve this by added a custom function to insert the headers on the wp_head hook, or use a plugin to add the headers to each page. The PHP header use a slightly different syntax:
```
header('Content-Security-Policy: "upgrade-insecure-requests"');
header('X-XSS-Protection: 1; mode=block');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: no-referrer-when-downgrade');
header('Expect-CT: max-age=7776000, enforce');
header('X-Frame-Options: sameorigin');
```
Thread Starter Chigolo
(@fitnsexy)

4 years, 6 months ago

Thx for the feedback @markwolters.
Which plugin can you recommend for it?

Plugin Contributor Rogier Lankhorst
(@rogierlankhorst)

4 years, 6 months ago

Please send a message to support(at)really-simple-plugins.com, then we can help you with this.

Thread Starter Chigolo
(@fitnsexy)

4 years, 6 months ago

Done @rogierlankhorst.

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘Error message after update to v:’ is closed to new replies.