savvylearner's Replies

Forum Replies Created

Viewing 3 replies - 1 through 3 (of 3 total)

Forum: Plugins
In reply to: [Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] Missing security headers SSL

savvylearner
(@savvylearner)

5 years, 6 months ago

UPDATE

I fine-tuned my policy following https://developers.google.com/web/fundamentals/security/csp#use_case_3_ssl_only . Now the site-health page loads, but doesn’t show the statistics as some resources are still blocked (e.g. use of eval() in JavaScript). Is there a way to use the header Content-Security-Policy without breaking something in WordPress?

Forum: Plugins
In reply to: [Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] Missing security headers SSL

savvylearner
(@savvylearner)

5 years, 6 months ago

UPDATE.

I found one problem. Apache wasn’t parsing .htaccess. I solved it by modifing /opt/bitnami/apps/wordpress/conf/httpd-app.conf (AllowOverride None --> AllowOverride All). I checked on securityheaders.com and it worked.

However, the “recommended improvement” message on my site-health page was still there. I noticed that the header Content-Security-Policy was missing from https://really-simple-ssl.com/site-health-recommended-security-headers/. Thus, I added Header set Content-Security-Policy "default-src 'self';" to my .htaccess but that disabled JavaScript on my website. Do you have any tip for me at this point? Thanks!

Forum: Plugins
In reply to: [Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] Missing security headers SSL
savvylearner
(@savvylearner)

5 years, 6 months ago
Hi @markwolters ,

I added
```
# BEGIN Really Simple SSL
Header always set Strict-Transport-Security: "max-age=31536000" env=HTTPS
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Expect-CT "max-age=7776000, enforce"
Header always set Referrer-Policy: "no-referrer-when-downgrade"
# END Really Simple SSL
```
at the top of my .htaccess file in /opt/bitnami/apps/wordpress/htdocs , but the “recommended improvement” message doesn’t go away. Also securityheaders.com shows that the headers added above aren’t active. What is the problem?

Viewing 3 replies - 1 through 3 (of 3 total)