VCNS Security Automation Manager

Description

Turning on strict security headers usually means picking between two bad options: leave Content-Security-Policy off and stay exposed, or turn it on and watch it silently break your checkout page, your embedded videos, or your analytics — with no warning before it happens.

Security Automation Manager takes a third option. It watches your site quietly first, in report-only mode, learning exactly which scripts, styles, and fonts your site actually loads — nothing gets blocked while it learns. Once you can see the whole picture, you approve a policy built from your real site, not a guess. Only then does it start enforcing.

Everything below is free, with nothing held back

• Content Security Policy that proposes itself from real traffic, runs report-only until you approve it, and keeps learning as your site changes.
• HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, and five more security headers, each shipped with sane, hardened defaults.
• Reverse tabnabbing protection, a third-party script inventory, and Subresource Integrity (SRI) hashing for everything your site pulls in from elsewhere.
• Free SSL/TLS certificates via Let’s Encrypt, issued and renewed automatically, with 41 built-in DNS providers for wildcard domains — Cloudflare, AWS Route 53, and Google Cloud DNS among them.

The WordPress.org edition is a complete free plugin with no subscription-locked functionality. VCNS also distributes a separate commercial edition that includes Fully Automatic mode and associated commercial services.

Built for the moment things go wrong, not just the moment you install it

Every policy change is written to an append-only audit log, with a reason recorded. Conflict detection catches another plugin or your host quietly emitting a competing security header before it confuses you. Nothing enforces without a report-only learning period first, on every pillar that supports one.

For the technically curious

CSP ships per-surface profiles, nonce injection, source discovery, violation reporting, policy-change review, and readiness checks, alongside conflict detection for any CSP header already being emitted elsewhere. Seven more pillars (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Strict-Transport-Security, Cross-Origin-Resource-Policy, X-Permitted-Cross-Domain-Policies) are straightforward per-surface toggles. Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy get their own lighter report-only workflow via the browser Reporting API (Chromium-based browsers only, as of this writing). Certificates issues and renews via ACME DNS-01 or HTTP-01 domain validation, with credentials and private keys encrypted at rest, deploying via cPanel, filesystem export, or manual download.

External services

This WordPress.org build does not contact third-party services for plugin updates, licensing, checkout, telemetry, or remote product configuration.

GitHub release builds are published separately for administrators who install from GitHub rather than WordPress.org; this update check is never present in the WordPress.org-channel package (this code is physically absent from it, not merely inactive). The GitHub-channel ZIP checks https://vcns.github.io/wp-updates/security-automation-manager/update.json from administrator update contexts only, validates the advertised package host and SHA-256 checksum, and then lets WordPress perform the update. This manifest is VCNS’s own infrastructure, not a third party; the request sends no personal or site-identifying data, only a plain HTTPS GET for a static, publicly-readable JSON file. The file is served from vcns.github.io, a GitHub Pages subdomain — GitHub Pages has no separate terms or privacy documents of its own; the whole *.github.io domain is governed entirely by GitHub’s own Terms of Service (https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) and Privacy Statement (https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement), the same as github.com itself. Define WP_SAM_DISABLE_AUTO_UPDATE as true in wp-config.php to prevent background auto-updates for the GitHub-channel package.

By default, the plugin emits CSP reporting headers that point browsers back to this WordPress site’s own REST endpoint:

• /wp-json/sam/v1/report

Administrators may override the reporting server URL when the public HTTPS endpoint differs from the WordPress-detected site URL, such as behind a proxy, CDN, or load balancer. If the override points to another host, browsers will send CSP reports to that configured endpoint; local report learning only works when the URL routes back to this plugin’s report endpoint.

Purpose:
* receive browser-generated CSP violation reports for this site;
* store reports locally so administrators can review and refine policy safely.

Data handled:
* browser CSP violation report fields such as blocked URL, document URL, violated directive, referrer, user agent, line/column where provided, and an optional script sample where the active policy requests report-sample.

Reports received by this plugin are validated and stored in this site’s WordPress database. They are not sent to any external provider by default.

For Cloudflare, CDN, and reverse-proxy deployments, administrators can configure an origin-only policy header name such as X-Origin-CSP-Policy. The proxy can then copy that origin header into the browser-facing Content-Security-Policy-Report-Only or Content-Security-Policy header.

The Scripts page’s External tab has a “Suggest” button, only triggered by an administrator explicitly clicking it, that fetches a URL the administrator themselves supplies (restricted to a third-party origin already observed on this site) and computes a Subresource Integrity hash from it, saving that hash immediately as the pinned value with no separate confirmation step. No content from that fetch is stored or sent anywhere else; only the computed hash is written to this site’s own database. Nothing is fetched automatically or in the background as part of this feature.

The Scripts page’s Internal tab, when enabled for a surface, reads this site’s own theme/plugin/core files directly from local disk to compute their Subresource Integrity hash — never a network fetch of any kind, since the file being hashed is the exact file this server is about to serve.

The Certificates page, only when an administrator configures it, requests TLS certificates over the ACME v2 protocol. Nothing is contacted until certificates are explicitly configured. Credentials and private keys are encrypted at rest. Issuing a certificate happens inside WordPress; installing it into the web server depends on your hosting platform — automatic installation uses cPanel’s install_ssl API where available, and https://vcns.github.io/security-automation-manager/certificates.html explains the basic steps for other platforms.

Every certificate request or renewal contacts the certificate authority:

• Let’s Encrypt (acme-v02.api.letsencrypt.org, or the staging equivalent), operated by the Internet Security Research Group (ISRG). Subscriber Agreement: https://letsencrypt.org/repository/ — Privacy Policy: https://letsencrypt.org/privacy/

Data sent to Let’s Encrypt: the domain name(s) being requested; the ACME account’s public-key material (used to sign every request and identify the account, never a private key); an optional contact email address, only if the administrator supplies one; the certificate signing request (CSR) at finalization; and challenge-response/validation data as the ACME protocol’s issuance flow requires.

When a DNS provider is selected for DNS-01 domain validation, that provider’s API is also contacted at certificate request and renewal time, using credentials the administrator supplies. Data sent depends on the specific request: API credentials/tokens on every call; the domain and DNS zone name; requests to discover which zone matches the domain; the DNS record name being created or deleted (always of the form _acme-challenge.<domain>); the ACME TXT challenge value; and, for providers that require it, an account, project, or zone identifier. This plugin includes 41 built-in DNS provider drivers; below is each one’s operating company and legal links, where the provider is a third-party service:

• Akamai (Edge DNS) — Akamai Technologies, Inc. — Terms: https://www.akamai.com/legal/portal-terms — Privacy: https://www.akamai.com/legal/privacy-statement
• Alibaba Cloud DNS — Alibaba Cloud — Terms: https://www.alibabacloud.com/help/en/legal/latest/alibaba-cloud-international-website-product-terms-of-service — Privacy: https://www.alibabacloud.com/help/en/legal/latest/alibaba-cloud-international-website-privacy-policy
• Microsoft Azure DNS — Microsoft Corporation — Terms and Privacy (agreement depends on purchase channel): https://azure.microsoft.com/en-us/support/legal/
• Bunny.net DNS — BunnyWay d.o.o. — Terms: https://bunny.net/tos/ — Privacy: https://bunny.net/privacy/
• Cloudflare DNS — Cloudflare, Inc. — Terms: https://www.cloudflare.com/terms/ — Privacy: https://www.cloudflare.com/privacypolicy/
• ClouDNS — Cloud DNS Ltd — Terms: https://www.cloudns.net/tos/ — Privacy: https://www.cloudns.net/privacy-policy/
• deSEC — deSEC e.V. — Terms: https://desec.io/terms/ — Privacy: https://desec.io/privacy-policy/
• DigitalOcean DNS — DigitalOcean, LLC — Terms: https://www.digitalocean.com/legal/terms-of-service-agreement — Privacy: https://www.digitalocean.com/legal/privacy-policy
• DNSimple — DNSimple Corporation — Terms: https://dnsimple.com/terms — Privacy: https://dnsimple.com/privacy
• DNS Made Easy (API: api.dnsmadeeasy.com — dnsmadeeasy.com itself has no separate legal pages of its own; its own site directs to DigiCert’s) — DigiCert, Inc. — Terms: https://www.digicert.com/legal-repository — Privacy: https://privacy.digicert.com/policies/en/?name=dns-network-security-products-privacy-notice
• DNSPod — Tencent Cloud — Terms: https://docs.dnspod.cn/account/terms-of-service/ — Privacy: https://docs.dnspod.cn/account/privacy-policy/ (Chinese-language)
• Domeneshop — Domeneshop AS — Terms and Privacy (single combined document, Norwegian-language): https://domene.shop/terms
• DreamHost DNS — DreamHost, LLC — Terms: https://www.dreamhost.com/legal/terms-of-service/ — Privacy: https://www.dreamhost.com/legal/privacy-policy/
• Dynu — Dynu Systems, Inc. — Terms: https://www.dynu.com/en-US/Legal/TermsOfUse — Privacy: https://www.dynu.com/en-US/Legal/PrivacyPolicy
• easyDNS — easyDNS Technologies Inc. — Terms: https://easydns.com/legal/terms-of-service/ — Privacy: https://easydns.com/legal/privacy-policy/
• Gandi DNS — Gandi SAS — Terms: https://www.gandi.net/en/contracts/terms-of-service — Privacy: https://www.gandi.net/en/contracts/privacy-policy
• GleSYS — Glesys AB — Terms: https://glesys.com/legal/general-terms-and-conditions/ — Privacy: https://glesys.com/legal/privacy-policy/
• GoDaddy DNS — GoDaddy.com, LLC — Terms: https://www.godaddy.com/legal/agreements/universal-terms-of-service-agreement — Privacy: https://www.godaddy.com/agreements/privacy
• Google Cloud DNS — Google LLC — Terms: https://cloud.google.com/terms — Privacy: https://cloud.google.com/terms/cloud-privacy-notice
• Hetzner DNS — Hetzner Online GmbH — Terms: https://www.hetzner.com/legal/terms-and-conditions/ — Privacy: https://www.hetzner.com/legal/privacy-policy/
• INWX (API: api.domrobot.com, DomRobot, INWX’s own API product — domrobot.com is an API-only hostname and does not resolve to a website of its own) — INWX GmbH — Terms: https://www.inwx.com/en/aboutus/terms — Privacy: https://www.inwx.com/en/aboutus/dataprotection
• IONOS DNS — IONOS Inc. — Terms: https://www.ionos.com/terms-gtc/general-terms-and-conditions/ — Privacy: https://www.ionos.com/terms-gtc/privacy-policy/
• Joker.com DNS — CSL Computer Service Langenbach GmbH — Terms: https://joker.com/terms/general — Privacy: https://joker.com/index.joker?mode=page&page=impressum
• Linode DNS — operated by Akamai Technologies since Linode’s acquisition — Terms: https://www.akamai.com/legal/msa — Privacy: https://www.akamai.com/legal/privacy-statement
• Mythic Beasts — Mythic Beasts Ltd — Terms: https://www.mythic-beasts.com/terms/overview — Privacy: https://www.mythic-beasts.com/terms/privacy
• Namecheap DNS — Namecheap, Inc. — Terms: https://www.namecheap.com/legal/universal/universal-tos/ — Privacy: https://www.namecheap.com/legal/general/privacy-policy/
• Name.com DNS — Name.com, Inc. — Terms: https://www.name.com/policies/registration-agreement — Privacy: https://www.name.com/privacy-policy
• NameSilo DNS — NameSilo, LLC — Terms: https://www.namesilo.com/support/v2/articles/general-terms/terms-and-conditions — Privacy: https://www.namesilo.com/support/v2/articles/general-terms/privacy-policy
• netcup DNS — netcup GmbH — Terms: https://www.netcup.com/en/terms-and-conditions — Privacy: https://www.netcup.com/en/contact/data-privacy
• Netlify DNS — Netlify, Inc. — Terms: https://www.netlify.com/legal/terms-of-use/ — Privacy: https://www.netlify.com/privacy/
• Njalla — operating entity not published — Terms (also covers data collection; no separate privacy policy is published): https://njal.la/tos/
• NS1 — operated by IBM since NS1’s acquisition — Terms: https://www.ibm.com/legal/terms — Privacy: https://www.ibm.com/us-en/privacy
• OVH DNS — OVH Groupe SA (OVHcloud) — Terms: https://www.ovhcloud.com/en/terms-and-conditions/ — Privacy: https://www.ovhcloud.com/en/terms-and-conditions/privacy-policy/
• Porkbun DNS — Porkbun LLC — Terms: https://porkbun.com/legal/agreement/product_terms_of_service — Privacy: https://porkbun.com/legal/agreement/privacy_policy
• AWS Route 53 — Amazon Web Services, Inc. — Terms: https://aws.amazon.com/agreement/ — Privacy: https://aws.amazon.com/privacy/
• Scaleway DNS — Scaleway S.A.S. — Terms: https://www.scaleway.com/en/contracts/ — Privacy: https://www.scaleway.com/en/privacy-policy/
• Vercel DNS — Vercel Inc. — Terms: https://vercel.com/legal/terms — Privacy: https://vercel.com/legal/privacy-policy
• Vultr DNS — The Constant Company, LLC — Terms: https://www.vultr.com/legal/tos/ — Privacy: https://www.vultr.com/legal/privacy/

The remaining three DNS-01 drivers (acme-dns, PowerDNS, and RFC 2136 dynamic DNS updates) are not third-party services: they contact infrastructure the administrator operates or points at themselves (a self-hosted acme-dns instance, a self-hosted PowerDNS Authoritative Server, or any DNS server speaking the RFC 2136 standard), so no external terms or privacy policy apply.

When an administrator configures automatic cPanel deployment, once a certificate is successfully issued the plugin sends an HTTPS request to the cPanel host the administrator specifies (cPanel’s UAPI SSL::install_ssl endpoint), containing: the cPanel account username and API token supplied by the administrator (as an Authorization header); the domain name; the issued certificate; the certificate chain; and the certificate’s private key. This is the one automatic-deployment method that transmits the private key itself, since installing a certificate requires it. Nothing is sent unless cPanel deployment is explicitly configured, and it happens once per issuance or renewal, immediately after the certificate is issued. Because the endpoint is the administrator’s own hosting provider, not a service this plugin operates or has a relationship with, no single Terms of Service or Privacy Policy governs it — those are whatever the administrator’s own hosting provider publishes for their account and API access.