=== HeaderGenie Security Headers ===
Contributors: headergenie
Tags: security, headers, csp, hsts, https
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.2.59
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add HTTP security headers from WordPress. Scan what your site sends and enable safe defaults. An optional HeaderGenie account unlocks CSP automation, SRI, and monitoring.

== Description ==

HeaderGenie sends HTTP security headers from PHP, so they work on Apache, Nginx, and hosts that ignore `.htaccess`.

On the free plan you can:

* Scan the public site and see which security headers are present, weak, or missing
* Enable headers such as `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, HSTS on HTTPS, Permissions-Policy, COOP, COEP, and CORP
* Configure a Content-Security-Policy yourself (report-only or enforce). Hosts are not added automatically
* Manage headers from **HeaderGenie** in wp-admin

An optional HeaderGenie Pro account (a paid service at [headergenie.com](https://headergenie.com)) unlocks:

* Automatic CSP missing-source detection from scans and browser reports
* Subresource Integrity and CSP nonces
* HSTS includeSubDomains / preload and Reporting-Endpoints
* Compatibility checks and cloud monitoring

The scanner and free-plan headers work with no account and do not contact HeaderGenie servers. The plugin only talks to the HeaderGenie API after you enter a license key on the License screen.

This plugin does not guarantee legal or compliance outcomes. It helps you set and review security headers.

== Installation ==

1. Upload the `header-genie` folder to `/wp-content/plugins/` or install the zip from **Plugins → Add Plugin**.
2. Activate **HeaderGenie**.
3. Open **HeaderGenie** in the admin menu.
4. Run a scan, then enable the headers you want.
5. Optional: paste a license key from [headergenie.com](https://headergenie.com) to unlock Pro features.

== Frequently Asked Questions ==

= Does the free version work without an account? =

Yes. Scanning, the free-plan headers, and manual CSP editing work locally. You need a HeaderGenie license for CSP auto-add, SRI/nonces, Compatibility, and cloud monitoring.

= Does the plugin change .htaccess? =

No. Headers are sent from PHP on front-end and login responses.

= Will this break my site? =

Core headers are conservative. CSP stays off until you enable it; start in report-only mode so you can review it before enforcing. CSP is not applied to wp-admin, AJAX, REST, or XML-RPC. Nonce-based CSP (Pro) needs the HTML and header generated together, so HeaderGenie asks page caches not to store those responses.

= What about page caches and CDNs? =

CSP nonces change on every response. Full-page caches (WP Rocket, LiteSpeed, Cloudflare APO, Varnish) can reuse a nonce or mismatch the HTML and CSP header. HeaderGenie sends `no-store` and sets `DONOTCACHEPAGE` when CSP is on. Turn off HTML caching at the CDN before enforcing.

= What data is sent if I activate a license? =

The plugin sends your license key, site URL, domain, WordPress version, and plugin version to `https://api.headergenie.com` so the key can be activated on this site. After activation, Pro also sends scan summaries and CSP report samples (blocked URLs and truncated script samples). A key can be active on one site at a time. Deactivate it before moving it to a new domain. Revealing a stored key requires your WordPress password.

= Can I update Pro from wp-admin? =

Yes, after this version is installed once. An active license shows HeaderGenie on Dashboard → Updates, the same way wordpress.org plugins do. Sites still on an older zip need one manual install of this release first.

= Can I use the same license on two WordPress sites? =

No. A key is active on one site at a time. If the domain or site URL changes, deactivate the key on the old site first, then activate it on the new one. Buy another Pro licence on the same HeaderGenie account for a second live site.

== External services ==

This plugin connects to the HeaderGenie license service at `https://api.headergenie.com` only after a site administrator enters a license key.

The service activates, validates, and deactivates that key, and (for Pro) returns monitoring data, plugin update metadata, and accepts scan or CSP reports. Requests include license key, domain, site URL, WordPress version, plugin version, scan header findings, site name, and CSP report fields such as blocked URLs and optional script samples (truncated). After a license is active, WordPress may also ask HeaderGenie whether a newer Pro zip is available.

Terms: https://headergenie.com
Privacy: https://headergenie.com

Without a license key, HeaderGenie does not contact that service.

== Changelog ==

= 1.2.59 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.58 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.57 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.56 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.55 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.54 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.53 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.52 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.51 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.50 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.49 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.48 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.47 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.46 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.45 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.44 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.43 =
* A ws:// websocket already allowed as wss:// is an info note on the scan report, not a warning.

= 1.2.42 =
* A scan lists websocket hosts from the page (`wss://`, and `ws://` upgraded to `wss://`) on connect-src.

= 1.2.41 =
* CSP review rows for inline hashes and nonces show the script or stylesheet, and the page it came from, under the hash.

= 1.2.40 =
* Every CSP review row has its own Add, including browser-reported inline script hashes and websocket hosts.
* A scan still does not write browser reports or content hashes into the policy.

= 1.2.39 =
* CSP review lists inline script/style hashes (`'sha256-…'`) so you can Add them without hunting manually.

= 1.2.38 =
* Shared release number with Free.
* Localhost header scan recovery unchanged (127.0.0.1 fallback).

= 1.2.37 =
* Browser CSP reports are review-only; they never auto-change the policy.
* Admins can still Add or Add all report-discovered hosts from the CSP gaps panel.

= 1.2.36 =
* Free plan: Permissions-Policy, COOP, COEP, CORP, and manual CSP.
* Pro keeps CSP auto-add, SRI, nonces, Compatibility, and monitoring.

= 1.2.35 =
* Additional CSP directives.
* Browser CSP reports surface missing sources in the admin gaps UI.

= 1.2.34 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.31 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.28 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.27 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.26 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.25 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.24 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.23 =
* SRI now pins versioned CDN files only and excludes rotating vendors (gtag, GTM, Stripe) by default.
* Scan treats excluded vendor scripts as accepted exceptions instead of failures.

= 1.2.22 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.21 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.20 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.19 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.18 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.17 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.16 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.15 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.14 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.13 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.12 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.11 =
* Display name aligned to HeaderGenie Security Headers.
* Shared release number with Free.

= 1.2.10 =
* Shared release number with Free.
* Harden SRI fetches, header allowlists, CSP collector auth, and admin escaping.

= 1.2.9 =
* Shared release number with Free.
* Harden SRI fetches, header allowlists, CSP collector auth, and admin escaping.

= 1.2.8 =
* Shared release number with Free.
* Harden SRI fetches, header allowlists, CSP collector auth, and admin escaping.

= 1.2.7 =
* Shared release number with Free.
* Harden SRI fetches, header allowlists, CSP collector auth, and admin escaping.

= 1.2.5 =
* Shared release number with Free.
* Harden SRI fetches, header allowlists, CSP collector auth, and admin escaping.

= 1.2.3 =
* Shared release number with Free.
* Harden SRI fetches, header allowlists, CSP collector auth, and admin escaping.

= 1.2.1 =
* Shared release number with Free.
* Harden SRI fetches, header allowlists, CSP collector auth, and admin escaping.

= 1.1.2 =
* Bypass WordPress page caches and send no-store when CSP nonces are active.
* Warn before enforcing CSP if a full-page cache or Cloudflare is detected.
* Hash SRI against the exact script URL, including the query string.
* Always send Reporting-Endpoints with CSP report-to.
* Stop copying script CDN hosts into connect-src during discovery.

= 1.1.1 =
* Split license API HMAC keys so the public plugin zip cannot sign website account requests.
* Issue a per-site signing secret on activation.
* Mask the license key in admin REST state and encrypt stored keys with AES-GCM.
* Keep auto-discovered CSP hosts in report-only mode until they are added to the policy.
* Apply CSP nonces to script-src-elem and rate-limit CSP reports.

= 1.1.0 =
* Prepared the plugin for WordPress.org (readme, license, i18n, uninstall, and review hardening).
* Default public API is https://api.headergenie.com. Outbound API calls require a license key except when activating one.

= 1.0.68 =
* Plugin and author links point to https://headergenie.com.

= 1.0.67 =
* CSP deny-by-default, HTTPS sources, same-origin report collector, and SRI for external scripts.

== Upgrade Notice ==

= 1.2.59 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.58 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.57 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.56 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.55 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.54 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.53 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.52 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.51 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.50 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.49 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.48 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.47 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.46 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.45 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.44 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.43 =
Scan reports mark a ws:// host as info once its wss:// form is in the policy.

= 1.2.42 =
A scan now lists websocket hosts on connect-src.

= 1.2.41 =
Hash and nonce review rows now show which script or stylesheet they came from.

= 1.2.40 =
Every CSP review row can be added on its own. Scans still leave browser reports and content hashes for you to approve.

= 1.2.39 =
CSP review can suggest inline script hashes to Add.

= 1.2.38 =
Shared release with Free.

= 1.2.37 =
Browser CSP reports require admin review before changing the policy.

= 1.2.36 =
Free plan headers and manual CSP; Pro automation unchanged.

= 1.2.35 =
Additional CSP directives and browser CSP report gaps.

= 1.2.34 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.31 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.28 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.27 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.26 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.25 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.24 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.23 =
SRI exclusions for rotating vendor scripts. Versioned CDN files can still be pinned.

= 1.2.22 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.21 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.20 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.19 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.18 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.17 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.16 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.15 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.14 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.13 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.12 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.11 =
Display name aligned to HeaderGenie Security Headers.

= 1.2.10 =
Shared release with Free, plus security hardening for SRI, headers, and the CSP collector.

= 1.2.9 =
Shared release with Free, plus security hardening for SRI, headers, and the CSP collector.

= 1.2.8 =
Shared release with Free, plus security hardening for SRI, headers, and the CSP collector.

= 1.2.7 =
Shared release with Free, plus security hardening for SRI, headers, and the CSP collector.

= 1.2.5 =
Shared release with Free, plus security hardening for SRI, headers, and the CSP collector.

= 1.2.3 =
Shared release with Free, plus security hardening for SRI, headers, and the CSP collector.

= 1.2.1 =
Shared release with Free, plus security hardening for SRI, headers, and the CSP collector.

= 1.1.2 =
CSP nonce cache handling, SRI URL accuracy, and reporting-endpoint pairing.

= 1.1.1 =
Security hardening for license API authentication, CSP enforcement, and license key handling.

= 1.1.0 =
WordPress.org-ready release with clearer license service disclosure and safer uninstall.
