=== Kareva Security Headers ===
Contributors: karevatechsol26, kareva
Donate link: https://www.kareva.in
Tags: security, headers, content security policy, hsts, csp
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.1.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Set HSTS, CSP, X-Frame-Options and other HTTP security headers from your dashboard, with presets, testing and reporting.

== Description ==

Kareva Security Headers helps protect your visitors from clickjacking, cross-site scripting, MIME sniffing and data leakage by sending modern HTTP security headers. No server access or code is needed.

= Features =

* One-click presets: Basic, Recommended, Strict and WooCommerce-safe
* Strict-Transport-Security (HSTS) with duration, subdomain and preload options
* Content Security Policy editor with report-only mode, per-request nonces and source validation
* Built-in CSP violation report collector with a one-click "Allow source" action
* X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy
* Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy
* X-Permitted-Cross-Domain-Policies and X-XSS-Protection
* Remove X-Powered-By, the generator tag, X-Pingback and the REST API discovery link
* Up to 20 custom headers, with protection against unsafe header names
* Scanner that shows the headers your pages actually send, with a local grade
* Apache, Nginx, LiteSpeed and IIS configuration snippets, plus optional .htaccess writing
* Path exclusions with wildcards
* Automatic snapshots before every change and one-click restore
* Import and export, multisite support, WP-CLI commands and developer hooks
* No tracking, no ads, no locked features

= Safe by design =

Nothing is sent until you choose a preset. The Recommended preset runs the Content Security Policy in report-only mode, so nothing is blocked while you review reports. If a header ever locks you out, add `define( 'KAREVA_SH_DISABLE', true );` to wp-config.php.

= WP-CLI =

* `wp kareva-sh status`
* `wp kareva-sh apply-preset <basic|recommended|strict|woocommerce>`
* `wp kareva-sh enable` / `wp kareva-sh disable`
* `wp kareva-sh export [--file=<path>]`
* `wp kareva-sh import <file>`
* `wp kareva-sh scan [<url>]`
* `wp kareva-sh purge-reports [--older-than=<days>]`

= For developers =

Filters: `kareva_sh_headers`, `kareva_sh_csp_directives`, `kareva_sh_admin_tabs`, `kareva_sh_accept_reports`, `kareva_sh_store_report`, `kareva_sh_is_excluded`, `kareva_sh_capability`, `kareva_sh_report_rate_limit`, `kareva_sh_report_global_limit`, `kareva_sh_max_reports`, `kareva_sh_client_ip`, `kareva_sh_presets`, `kareva_sh_csp_in_admin`, `kareva_sh_known_conflicts`.

If your site is behind a proxy or CDN, every visitor shares the proxy's address for report rate limiting. Use `kareva_sh_client_ip` to return the real visitor address from a header your proxy sets and that visitors cannot forge.

Actions: `kareva_sh_settings_saved`, `kareva_sh_before_send_headers`, `kareva_sh_report_received`.

Themes can print the current CSP nonce with `kareva_sh_get_nonce()`.

= Support =

Use the support forum on WordPress.org or email support@kareva.in. Built by [Kareva Techsol](https://www.kareva.in).

== External services ==

**Freemius (optional opt-in and upgrades).** The plugin includes the Freemius SDK. It is used for an optional usage opt-in and for the "Upgrade" page where you can buy the separate Pro version. No feature of this plugin depends on Freemius or on a licence. On first activation you are asked whether to opt in; you can skip, and nothing is sent unless you opt in or start a purchase or trial. If you opt in, Freemius receives your site address, WordPress and PHP versions, plugin version, and your name and email address; it also receives activation, deactivation and uninstall events (with any feedback you choose to give). You can opt out at any time from the plugin's Account page. Freemius [Terms](https://freemius.com/terms/) and [Privacy Policy](https://freemius.com/privacy/).

Apart from Freemius as described above, the plugin contacts no external service on its own.

* The Scanner requests pages on your own site only, when you click "Scan page".
* The "Check on securityheaders.com" link on the Scanner screen opens securityheaders.com in your browser only when you click it. That site, operated by Snyk, receives the address of the scanned page. Snyk [Terms of Use](https://snyk.io/policies/website-terms-of-use/) and [Privacy Notice](https://snyk.io/policies/privacy/).
* If you enter an external report URL on the Content Security Policy screen, your visitors' browsers send violation reports (blocked resource address, page address and policy rule) to that URL. This is off unless you set it.

== Installation ==

1. In your dashboard go to Plugins > Add New, search for "Kareva Security Headers" and click Install Now. Or upload the zip under Plugins > Add New > Upload Plugin.
2. Activate the plugin.
3. Go to Security Headers, choose a preset and click Apply.
4. Open the Scanner tab and click Scan page to confirm the headers are sent.

== Frequently Asked Questions ==

= Will this break my site? =

The Basic and Recommended presets use low-risk headers, and Recommended runs the Content Security Policy in report-only mode, so nothing is blocked. Review the Reports tab before switching to enforce mode.

= My headers do not appear. Why? =

A page cache plugin or CDN may be serving cached pages. Clear the cache after saving. Some hosts strip or override headers; in that case use the server configuration snippets on the Tools tab.

= Do the headers apply to images, CSS and JavaScript files? =

Headers sent by PHP apply to pages WordPress generates. Static files are served directly by your web server, so use the snippets on the Tools tab to cover them.

= Does it work with Nginx? =

Yes. Sending from PHP works on any server. For static files, copy the Nginx snippet from the Tools tab into your server block.

= Should I enable HSTS preload? =

Only if every subdomain supports HTTPS permanently. Browsers ship the preload list, so removal takes months.

= Why is the Content Security Policy not sent on the dashboard? =

WordPress and many plugins rely on inline scripts in the dashboard and on the login page. Developers can opt in with the `kareva_sh_csp_in_admin` filter.

= Does the plugin collect personal data? =

When reporting is on, browsers send reports that include the page address (stored without its query string), the blocked resource address and the rule involved. IP addresses and browser details are not stored. Reports are deleted after 30 days by default. Suggested privacy policy text is added under Settings > Privacy.

= I locked myself out. What now? =

Add `define( 'KAREVA_SH_DISABLE', true );` to wp-config.php, fix the setting, then remove the line. This also removes any headers the plugin wrote to .htaccess the next time a page loads. You can also restore a snapshot on the Tools tab.

= Is there a Pro version? =

Yes, as a separate premium plugin sold on our website. Everything in this plugin is free and fully functional. Kareva Security Headers Pro adds tools for building and monitoring a strict policy: CSP learning mode (proposes a complete policy from real reports), page rules (a different policy or mode on chosen paths), one-click source packs for common services, scheduled monitoring with email alerts, and report tools (CSV export, grouped summary, browser-extension noise filter, room for 50,000 reports). See the Pro tab in the plugin.

== Screenshots ==

1. Dashboard with status, presets and header preview
2. Header settings
3. Content Security Policy editor
4. Violation reports with one-click allow
5. Scanner results and local grade
6. Tools: export, snapshots and server snippets

== Changelog ==

= 1.1.1 =
* Change: the Pro tab only describes the separate Pro version; the free plugin contains no licence checks.

= 1.1.0 =
* New: optional Pro version, with a Pro tab describing it. All existing features remain free.
* New: Freemius SDK for licences and an optional, skippable usage opt-in (see External services).
* Dev: new filters `kareva_sh_admin_tabs`, `kareva_sh_accept_reports` and `kareva_sh_store_report`; `kareva_sh_csp_directives` and `kareva_sh_headers` receive a third argument telling whether the policy is built for a server config file.
* Change: uninstall cleanup now runs through Freemius after its uninstall feedback step. Scheduled events are cleared on deactivation and uninstall.

= 1.0.1 =
* Security: the .htaccess block now skips admin and login screens, only fills in headers a response does not already have (no more duplicate headers or a second, nonce-less CSP), is rewritten on every save, and is removed when headers are turned off, reset or KAREVA_SH_DISABLE is set.
* Security: the "Allow source" button names the exact source and directive and warns that reports can be faked.
* Security: report rate limits now count reports rather than requests, use fixed one-minute windows, and add a site-wide limit (600 per minute) and a cap on stored reports (5,000). The `kareva_sh_report_rate_limit` filter now counts reports.
* Security: custom headers can no longer set Content-Type, Cache-Control, Refresh, Clear-Site-Data and other headers that affect caching, redirects or body format. Such headers saved by 1.0.0 are no longer sent.
* Fix: invalid CSP sources (for example a typed 'nonce-…' value or a misspelt keyword) are no longer turned into host names, text after a ";" is no longer merged into the directive, and you are told which values were left out.
* Fix: external report URLs containing ; , quotes or spaces are rejected.
* Fix: path exclusions match whole path segments ("/shop" no longer excludes "/shopping") and work with non-ASCII paths.
* Fix: the scanner no longer follows redirects to other sites.
* New: warning when nonce mode is used with a page cache.
* Dev: all database queries use prepared identifiers (%i).

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.1.1 =
Maintenance release. No changes to how headers are sent.

= 1.1.0 =
Adds an optional Pro version. All existing features remain free; the usage opt-in can be skipped.

= 1.0.1 =
Security update. Fixes duplicate headers from the .htaccess option, hardens the violation report collector and blocks risky custom headers. If you wrote headers to .htaccess, they are rewritten automatically the next time an administrator opens the dashboard.

= 1.0.0 =
Initial release.
