SERIOUS ISSUE

  • GIORGOS DIMOPOULOS

    (@giorgos_d2)


    4 days, 5 hours ago

    Even though it runs normally on newest version of plugin on my website and even though it had an A grade rating in https://securityheaders.com , it dropped to D grade without me messing with anything, what’s wrong? i cant understand , it became again suddenly grade A , only Content-Security-Policy is in red , I didn’t mess anything up.

Viewing 1 replies (of 1 total)
  • Plugin Author Andrea Ferro

    (@unicorn03)

    3 days, 4 hours ago

    Hi Giorgos,

    Thanks for reporting this. The fluctuation you i describe is a known issue with version 5.3.4: headers were sent only through PHP, so a page served straight from your cache (which never runs PHP) had no headers, while a freshly generated page did. Scanners hitting one or the other explain the A / D swing you saw.

    Version 5.3.5, released yesterday, fixes this: on Apache and LiteSpeed the plugin writes the headers to your .htaccess again, so cached and static responses carry them too. Please update and let me know if the grade stays stable.

    If you already have 5.3.5 installed, go to Settings > Headers Security Advanced & HSTS WP and click Save changes: that forces the .htaccess block to be written.

    Content-Security-Policy is intentionally sent via PHP only on the front-end, never written to .htaccess, so a strict or nonce-based policy does not reach wp-admin or get frozen into a cached file. If the CSP shows as missing in the scan, tell me which cache plugin you use and I’ll look into it.

    Andrea

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.