=== Jeelsh HTTP Headers ===
Contributors: jeelshy
Tags: http headers, security headers, csp, hsts, wordpress security
Requires at least: 5.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Configure advanced HTTP security headers for your WordPress site.

== Description ==

Jeelsh HTTP Headers gives you an easy-to-use interface inside your WordPress dashboard to set HTTP response headers that improve your site's security and compliance.

With this plugin you can configure:

* Content-Security-Policy (CSP) headers
* HTTP Strict Transport Security (HSTS)
* Referrer-Policy
* X-Frame-Options
* Permissions-Policy
* X-Content-Type-Options
* X-Permitted-Cross-Domain-Policies
* Your own custom headers

All settings are validated and applied safely without touching your site's core files.

== Features ==

* Intuitive React-based admin panel
* Predefined security headers with helpful descriptions
* Custom header support
* Settings validation before saving
* Works out of the box with pre-built assets
* No external service dependencies by default

== Requirements ==

* WordPress 5.0 or higher
* PHP 7.4 or higher

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/jeelsh-http-headers` directory, or install the plugin through the WordPress Plugins screen.
2. Activate the plugin through the Plugins screen in WordPress.
3. Open **Jeelsh HTTP Headers** from the WordPress administration menu to configure your headers.

== Frequently Asked Questions ==

= Is the plugin GPL-compatible? =

Yes. Jeelsh HTTP Headers is licensed under the GNU General Public License v2.0 or later.

= Does the plugin require a third-party service? =

No, not by default. Header configuration and validation run within your WordPress installation. For details on optional user-initiated connections, see the External Services section below.

= Can I add my own custom headers? =

Yes. The plugin includes a custom headers section where you can define additional HTTP headers.

== External Services ==

This plugin does not connect to any third-party service by default. The following items are documented for transparency:

* CSP report-uri: If you configure a report-uri in the CSP settings, the browser will send CSP violation reports to the user-provided URL. The plugin does not provide or operate that endpoint; the site administrator chooses and controls it. By default the report-uri field is empty and no reports are sent.

* Example domains in settings fields: Inputs such as https://example.com and https://api.example.com use IANA-reserved example domains as placeholders only. The plugin does not connect to them.

* GitHub documentation link: The admin sidebar includes a link to https://github.com/jeelsh/http-headers. It opens only when a user clicks it. GitHub is operated by GitHub, Inc.; for terms and privacy, see https://docs.github.com/en/site-policy/github-terms/github-terms-of-service and https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement.

* Support email link: The admin sidebar includes a mailto:jeelsh@protonmail.com link. It opens the user's email client; the plugin does not send any data.

* WordPress REST API and admin-ajax: Saving and validating settings uses the site's own WordPress REST API endpoints and admin-ajax.php. These are same-site, internal communications.

== Privacy ==

Jeelsh HTTP Headers does not collect, store, or transmit any personal data on its own. All header configuration is stored in your WordPress database. The only optional external communication is a CSP report-uri that you, the site administrator, choose to configure.

== Support ==

For help, documentation, and bug reports, visit the GitHub repository: https://github.com/jeelsh/http-headers

For direct support, you can also email jeelsh@protonmail.com.

== Development ==

The plugin's user interface is built with React. The source code is available for review on GitHub: https://github.com/jeelsh/http-headers

For build and development instructions, see `DEVELOPMENT.md`.

== Changelog ==

= 1.0.2 (2026-08-02) =

* Fixed header injection not applying on wp-admin and wp-login.php.
* Added a check for Apache's mod_headers before allowing the .htaccess injection method, with automatic fallback to PHP-based injection.
* Fixed a 404 on bundled font assets caused by absolute asset URLs in the compiled CSS.
* Finished the rebrand from "HTTP Headers Advanced" to "Jeelsh HTTP Headers" internal keys and translation files.
* Admin panel visual adjustments and new UI components.

= 1.0.1 (2026-07-31) =

* Improved the admin panel display.
* Improved plugin documentation.

= 1.0.0 (2026-07-31) =

* First release.
* Configure Content-Security-Policy (CSP) headers to define which content sources the browser is allowed to load.
* Configure HTTP Strict Transport Security (HSTS) to enforce HTTPS connections across the site.
* Configure Referrer-Policy to control how much referrer information is shared with requests.
* Configure X-Frame-Options to prevent clickjacking by restricting iframe embedding.
* Configure Permissions-Policy to restrict which browser features can be used on the site.
* Configure X-Content-Type-Options to prevent MIME-type sniffing by browsers.
* Configure X-Permitted-Cross-Domain-Policies to manage cross-domain Adobe Flash/Reader behavior.
* Add custom HTTP headers to cover any additional site requirement.
* Validate settings before saving to ensure headers are applied with correct and safe values.