=== Beplus Security Headers & Script Auditor ===
Contributors: rimbeplus
Tags: security, headers, csp, content security policy, http headers
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Enable common HTTP security headers, scan your site for external scripts/styles, and pick your own Content-Security-Policy rules.

== Description ==

Beplus Security Headers & Script Auditor gives WordPress site owners everything needed to add security headers — and a Content-Security-Policy — without breaking their site:

1. **Security header toggles** — enable X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security, Permissions-Policy, Content-Security-Policy (with an optional report-only mode), and the legacy X-XSS-Protection header, each with sensible defaults. Headers are sent on your public pages and, optionally, on wp-admin, the login page and the REST API too.
2. **A live header check** — requests your site the way a visitor would and shows which headers actually arrive. If a page cache, CDN or server configuration drops or overrides a header, you'll see it.
3. **A scanner** — fetches your homepage, or optionally your whole site (up to 200 of your most recently published posts/pages), and lists every external script, stylesheet, font, image, video/audio, iframe and form target it finds, plus inline scripts/styles. Well-known services such as Google Fonts, Google Analytics, Stripe and reCAPTCHA also get the extra origins they load at runtime, so the suggested policy doesn't break them.
4. **Recommendations you control** — every finding is listed as a checkbox row; uncheck anything you don't want, and the Content-Security-Policy preview updates live. Apply the checked rows to the CSP field with one click, review it, then press Save. Nothing is ever applied automatically.
5. **CSP violation reports** — in report-only mode, visitors' browsers report what the policy would block to your own site. The CSP Reports tab lists each blocked resource with a one-click "Add to policy" button, so you can tighten your policy from real data before enforcing it.

There's also a repeatable table for adding any other custom response header your site needs.

= Why use this plugin =

* No external service calls, tracking, or phone-home behaviour — the scanner and header check only request pages on your own site, and CSP reports are sent by browsers to your own site.
* Every setting is sanitized on save, and header values are stripped of line breaks to prevent HTTP header injection.
* Sensible, conservative defaults: only X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are enabled out of the box. HSTS, Permissions-Policy, CSP, and X-XSS-Protection are opt-in since they can affect how your site behaves and should be reviewed first.

= Privacy =

When "Collect violation reports" is turned on, visitors' browsers send Content-Security-Policy violation reports to a REST API endpoint on your own site (`/wp-json/beplus-shsa/v1/csp-report`). The plugin stores only the violated directive, the blocked origin or keyword (e.g. `https://cdn.example.com` or `inline`), the path of the page, a count and timestamps. IP addresses, user agents, query strings and full URLs are never stored. Reports are kept until you clear them or uninstall the plugin. This feature is off by default.

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/beplus-security-headers-script-auditor` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Go to the "Security Headers" menu item (in the main admin sidebar) to review the default header configuration.
4. Open the Scanner tab and click "Run Scan" (optionally ticking "Scan entire site" first) to see what external resources your site loads, uncheck anything you don't want, then apply the checked rows to the Content-Security-Policy field.
5. Click "Save Changes" to apply your configuration.

== Frequently Asked Questions ==

= Will this break my site if I enable everything at once? =

It can, especially Content-Security-Policy. Start with the scanner recommendations, use "Report-only mode" for CSP first to observe without blocking anything, and only switch to enforcing mode once you've confirmed the policy covers everything your site actually loads.

= Does the scanner send my data anywhere? =

No. It performs normal HTTP requests from your own server to pages on your own site, using the built-in WordPress HTTP API. Nothing is sent to any third party.

= My settings are saved but the headers don't show up. Why? =

Click "Check live headers" on the Headers tab. If headers are missing, a page cache, CDN or your web server is usually serving the page without going through WordPress — clear the cache, or add the headers in your server/CDN configuration. If a header is shown as overridden or sent twice, it's also being set somewhere else (server, CDN or another plugin); set each header in only one place.

= Are headers sent on wp-admin and the login page? =

Yes, by default (since 1.1.0): every header except Content-Security-Policy and X-Frame-Options is also sent on wp-admin, the login page, admin-ajax and the REST API. CSP is left out because it could break the block editor and other admin screens, and WordPress already protects these pages from being framed. You can turn this off on the Headers tab.

= How do CSP violation reports work? =

Enable Content-Security-Policy in report-only mode and tick "Collect violation reports". Browsers then report anything your policy would block to your own site, and the CSP Reports tab lists each blocked resource with an "Add to policy" button. Browser extensions can trigger reports too, so only add sources you recognise. Counts are approximate under heavy traffic. On HTTPS sites, Chromium-based browsers use the Reporting API, which can delay reports by up to a minute.

= Does this replace a full security audit? =

No. Even the whole-site option only scans your homepage plus your most recently published posts/pages (capped at 200) and is meant as a starting point for building a Content-Security-Policy, not a substitute for a complete security review of your site.

== Screenshots ==

1. The Headers tab with the live header check, showing which headers actually reach visitors.
2. The Scanner tab, showing detected external resources (including those inferred for Google Fonts and Analytics) and a live Content-Security-Policy preview.
3. The CSP Reports tab, listing blocked resources with a one-click "Add to policy" button.
4. Security header settings, including HSTS and Content-Security-Policy with report collection.

== Changelog ==

= 1.1.0 =
* New: Live header check — requests your site like a visitor and shows which headers actually arrive, flagging headers dropped by a page cache/CDN or overridden by the server.
* New: CSP violation reports — collect report-only (or enforced) CSP violations from visitors' browsers on your own site, review them on the new CSP Reports tab and add sources to your policy in one click.
* New: Headers (except CSP and X-Frame-Options) are now also sent on wp-admin, the login page, admin-ajax and the REST API. Previously they were only sent on front-end pages. Can be turned off.
* New: The scanner now detects web fonts, video/audio, srcset images, preloaded resources and fonts/images referenced from inline CSS, and adds the extra origins well-known services need at runtime (Google Fonts, Google Analytics/Tag Manager, Stripe, reCAPTCHA, Meta Pixel, Cloudflare Web Analytics, YouTube, Vimeo).
* New: Suggested policies include `object-src 'none'`, `base-uri 'self'` and `frame-ancestors 'self'`.
* New: "Settings" link on the Plugins screen.
* Fix: A policy suggested for a site using Google Fonts or Google Analytics blocked the fonts and analytics requests once enforced, because font and connect sources were never detected.
* Fix: Ticking HSTS "preload" now also applies includeSubDomains and a max-age of at least one year, which preloading requires.
* Fix: JSON-LD and other non-JavaScript script blocks no longer count as inline scripts.

= 1.0.1 =
* Fix: The Permissions-Policy and Content-Security-Policy fields ("one directive per line") joined lines with a plain space instead of the separator each header actually requires. Permissions-Policy needs a comma between directives — the plugin's own default value (three directives, no commas) sent an invalid header out of the box whenever the feature was enabled. CSP needs a semicolon between directives; a manually-added line without a trailing `;` merged into the previous directive.

= 1.0.0 =
* Initial release: security header toggles, homepage/whole-site scanner with a pick-and-choose CSP checklist, and custom header repeater.

== Upgrade Notice ==

= 1.1.0 =
Adds a live header check and CSP violation reports, sends headers on wp-admin/login/REST too, and fixes suggested policies that could block Google Fonts or Analytics.

= 1.0.1 =
Recommended update: fixes an invalid Permissions-Policy header sent with the plugin's own default settings, and a similar risk in manually-edited CSP values.

= 1.0.0 =
Initial release.
