a:5:{s:4:"slug";s:7:"headers";s:10:"properties";a:13:{s:4:"slug";s:7:"headers";s:4:"name";s:12:"HTTP Headers";s:21:"show_module_menu_item";b:0;s:19:"show_module_options";b:1;s:11:"storage_key";s:7:"headers";s:7:"tagline";s:29:"Control HTTP Security Headers";s:12:"show_central";b:1;s:17:"access_restricted";b:1;s:7:"premium";b:0;s:18:"run_if_whitelisted";b:0;s:19:"run_if_verified_bot";b:1;s:12:"run_if_wpcli";b:0;s:5:"order";i:80;}s:8:"sections";a:4:{i:0;a:5:{s:4:"slug";s:24:"section_security_headers";s:7:"primary";b:1;s:5:"title";s:25:"Advanced Security Headers";s:11:"title_short";s:16:"Security Headers";s:7:"summary";a:2:{i:0;s:92:"Purpose - Protect visitors to your site by implementing increased security response headers.";i:1;s:101:"Recommendation - Enabling these features are advised, but you must test them on your site thoroughly.";}}i:1;a:4:{s:4:"slug";s:31:"section_content_security_policy";s:5:"title";s:23:"Content Security Policy";s:11:"title_short";s:23:"Content Security Policy";s:7:"summary";a:2:{i:0;s:105:"Purpose - Restrict the sources and types of content that may be loaded and processed by visitor browsers.";i:1;s:101:"Recommendation - Enabling these features are advised, but you must test them on your site thoroughly.";}}i:2;a:4:{s:4:"slug";s:37:"section_enable_plugin_feature_headers";s:5:"title";s:27:"Enable Module: HTTP Headers";s:11:"title_short";s:14:"Disable Module";s:7:"summary";a:2:{i:0;s:92:"Purpose - Protect visitors to your site by implementing increased security response headers.";i:1;s:101:"Recommendation - Enabling these features are advised, but you must test them on your site thoroughly.";}}i:3;a:2:{s:4:"slug";s:14:"section_non_ui";s:6:"hidden";b:1;}}s:7:"options";a:13:{i:0;a:9:{s:3:"key";s:14:"enable_headers";s:7:"section";s:37:"section_enable_plugin_feature_headers";s:7:"default";s:1:"Y";s:4:"type";s:8:"checkbox";s:9:"link_info";s:19:"https://shsec.io/aj";s:9:"link_blog";s:19:"https://shsec.io/7c";s:4:"name";s:19:"Enable HTTP Headers";s:7:"summary";s:43:"Enable (or Disable) The HTTP Headers module";s:11:"description";s:71:"Un-Checking this option will completely disable the HTTP Headers module";}i:1;a:10:{s:3:"key";s:7:"x_frame";s:7:"section";s:24:"section_security_headers";s:7:"default";s:13:"on_sameorigin";s:4:"type";s:6:"select";s:13:"value_options";a:3:{i:0;a:2:{s:9:"value_key";s:3:"off";s:4:"text";s:24:"Off: iFrames Not Blocked";}i:1;a:2:{s:9:"value_key";s:13:"on_sameorigin";s:4:"text";s:36:"On: Allow iFrames On The Same Domain";}i:2;a:2:{s:9:"value_key";s:7:"on_deny";s:4:"text";s:21:"On: Block All iFrames";}}s:9:"link_info";s:19:"https://shsec.io/78";s:9:"link_blog";s:19:"https://shsec.io/7c";s:4:"name";s:13:"Block iFrames";s:7:"summary";s:33:"Block Remote iFrames Of This Site";s:11:"description";s:139:"The setting prevents any external website from embedding your site in an iFrame. This is useful for preventing so-called ClickJack attacks.";}i:2;a:9:{s:3:"key";s:13:"x_xss_protect";s:7:"section";s:24:"section_security_headers";s:7:"default";s:1:"Y";s:4:"type";s:8:"checkbox";s:9:"link_info";s:19:"https://shsec.io/79";s:9:"link_blog";s:19:"https://shsec.io/7c";s:4:"name";s:14:"XSS Protection";s:7:"summary";s:38:"Employ Built-In Browser XSS Protection";s:11:"description";s:80:"Directs compatible browsers to block what they detect as Reflective XSS attacks.";}i:3;a:9:{s:3:"key";s:14:"x_content_type";s:7:"section";s:24:"section_security_headers";s:7:"default";s:1:"Y";s:4:"type";s:8:"checkbox";s:9:"link_info";s:19:"https://shsec.io/7a";s:9:"link_blog";s:19:"https://shsec.io/7c";s:4:"name";s:18:"Prevent Mime-Sniff";s:7:"summary";s:27:"Turn-Off Browser Mime-Sniff";s:11:"description";s:60:"Reduces visitor exposure to malicious user-uploaded content.";}i:4;a:11:{s:3:"key";s:17:"x_referrer_policy";s:7:"section";s:24:"section_security_headers";s:9:"sensitive";b:0;s:4:"type";s:6:"select";s:7:"default";s:10:"unsafe-url";s:13:"value_options";a:10:{i:0;a:2:{s:9:"value_key";s:10:"unsafe-url";s:4:"text";s:45:"Default: Full Referrer URL (aka 'Unsafe URL')";}i:1;a:2:{s:9:"value_key";s:11:"no-referrer";s:4:"text";s:11:"No Referrer";}i:2;a:2:{s:9:"value_key";s:26:"no-referrer-when-downgrade";s:4:"text";s:26:"No Referrer When Downgrade";}i:3;a:2:{s:9:"value_key";s:11:"same-origin";s:4:"text";s:11:"Same Origin";}i:4;a:2:{s:9:"value_key";s:6:"origin";s:4:"text";s:6:"Origin";}i:5;a:2:{s:9:"value_key";s:13:"strict-origin";s:4:"text";s:13:"Strict Origin";}i:6;a:2:{s:9:"value_key";s:24:"origin-when-cross-origin";s:4:"text";s:24:"Origin When Cross-Origin";}i:7;a:2:{s:9:"value_key";s:31:"strict-origin-when-cross-origin";s:4:"text";s:31:"Strict Origin When Cross-Origin";}i:8;a:2:{s:9:"value_key";s:5:"empty";s:4:"text";s:12:"Empty Header";}i:9;a:2:{s:9:"value_key";s:8:"disabled";s:4:"text";s:33:"Disabled - Don't Send This Header";}}s:9:"link_info";s:19:"https://shsec.io/a5";s:9:"link_blog";s:0:"";s:4:"name";s:15:"Referrer Policy";s:7:"summary";s:22:"Referrer Policy Header";s:11:"description";s:141:"The Referrer Policy Header allows you to control when and what referral information a browser may pass along with links clicked on your site.";}i:5;a:9:{s:3:"key";s:32:"enable_x_content_security_policy";s:7:"section";s:31:"section_content_security_policy";s:7:"default";s:1:"N";s:4:"type";s:8:"checkbox";s:9:"link_info";s:19:"https://shsec.io/7d";s:9:"link_blog";s:19:"https://shsec.io/7c";s:4:"name";s:30:"Enable Content Security Policy";s:7:"summary";s:54:"Enable (or Disable) The Content Security Policy module";s:11:"description";s:75:"Allows for permission and restriction of all resources loaded on your site.";}i:6;a:9:{s:3:"key";s:9:"xcsp_self";s:7:"section";s:31:"section_content_security_policy";s:7:"default";s:1:"Y";s:4:"type";s:8:"checkbox";s:9:"link_info";s:0:"";s:9:"link_blog";s:0:"";s:4:"name";s:4:"Self";s:7:"summary";s:22:"Allow 'self' Directive";s:11:"description";s:117:"Using 'self' is generally recommended. It essentially means that resources from your own host:protocol are permitted.";}i:7;a:9:{s:3:"key";s:11:"xcsp_inline";s:7:"section";s:31:"section_content_security_policy";s:7:"default";s:1:"Y";s:4:"type";s:8:"checkbox";s:9:"link_info";s:0:"";s:9:"link_blog";s:0:"";s:4:"name";s:15:"Inline Entities";s:7:"summary";s:28:"Allow Inline Scripts and CSS";s:11:"description";s:76:"Allows parsing of Javascript and CSS declared in-line in your html document.";}i:8;a:9:{s:3:"key";s:9:"xcsp_data";s:7:"section";s:31:"section_content_security_policy";s:7:"default";s:1:"Y";s:4:"type";s:8:"checkbox";s:9:"link_info";s:0:"";s:9:"link_blog";s:0:"";s:4:"name";s:13:"Embedded Data";s:7:"summary";s:24:"Allow 'data:' Directives";s:11:"description";s:80:"Allows use of embedded data directives, most commonly used for images and fonts.";}i:9;a:9:{s:3:"key";s:9:"xcsp_eval";s:7:"section";s:31:"section_content_security_policy";s:7:"default";s:1:"Y";s:4:"type";s:8:"checkbox";s:9:"link_info";s:0:"";s:9:"link_blog";s:0:"";s:4:"name";s:12:"Allow eval()";s:7:"summary";s:23:"Allow Javascript eval()";s:11:"description";s:50:"Permits the use of Javascript the eval() function.";}i:10;a:9:{s:3:"key";s:10:"xcsp_https";s:7:"section";s:31:"section_content_security_policy";s:7:"default";s:1:"N";s:4:"type";s:8:"checkbox";s:9:"link_info";s:0:"";s:9:"link_blog";s:0:"";s:4:"name";s:5:"HTTPS";s:7:"summary";s:22:"HTTPS Resource Loading";s:11:"description";s:50:"Allows loading of any content provided over HTTPS.";}i:11;a:10:{s:3:"key";s:10:"xcsp_hosts";s:7:"section";s:31:"section_content_security_policy";s:9:"sensitive";b:1;s:7:"default";a:1:{i:0;s:1:"*";}s:4:"type";s:5:"array";s:9:"link_info";s:19:"https://shsec.io/ga";s:9:"link_blog";s:0:"";s:4:"name";s:15:"Permitted Hosts";s:7:"summary";s:27:"Permitted Hosts and Domains";s:11:"description";s:276:"You can explicitly state which hosts/domain from which content may be loaded. Take great care and test your site as you may block legitimate resources. If in-doubt, leave blank or use '*' only. Note: You can force only HTTPS for a given domain by prefixing it with 'https://'.";}i:12;a:10:{s:3:"key";s:11:"xcsp_custom";s:7:"section";s:31:"section_content_security_policy";s:7:"premium";b:1;s:7:"default";a:0:{}s:4:"type";s:5:"array";s:9:"link_info";s:19:"https://shsec.io/g9";s:9:"link_blog";s:0:"";s:4:"name";s:12:"Manual Rules";s:7:"summary";s:16:"Manual CSP Rules";s:11:"description";s:58:"Manual CSP rules which are not covered by the rules above.";}}s:10:"meta_modts";i:1582499933;}