Title: Esmertec's Replies | WordPress.org --- # Esmertec [ ](https://wordpress.org/support/users/esmertec/) * [Profile](https://wordpress.org/support/users/esmertec/) * [Topics Started](https://wordpress.org/support/users/esmertec/topics/) * [Replies Created](https://wordpress.org/support/users/esmertec/replies/) * [Reviews Written](https://wordpress.org/support/users/esmertec/reviews/) * [Topics Replied To](https://wordpress.org/support/users/esmertec/replied-to/) * [Engagements](https://wordpress.org/support/users/esmertec/engagements/) * [Favorites](https://wordpress.org/support/users/esmertec/favorites/) Search replies: ## Forum Replies Created Viewing 14 replies - 1 through 14 (of 14 total) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] SSL headers are displayed incorrectly](https://wordpress.org/support/topic/ssl-headers-are-displayed-incorrectly/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [1 year, 6 months ago](https://wordpress.org/support/topic/ssl-headers-are-displayed-incorrectly/#post-18258043) * [@jarnovos](https://wordpress.org/support/users/jarnovos/), the matter turned out to be much simpler than I thought, I simply turned off the plugin and turned it on again, the notification about headers disappeared after this operation) I also installed a free third-party firewall to test the functions. There is one notification left in site health about the need to limit user login attempts. * P.S. I don’t want to buy any functions in plugins yet, since the audience of my site is too insignificant, so I want to get by with minimal costs for now =)) in theory the easiest way out of the situation is to buy the pro version from rsssl =D * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] SSL headers are displayed incorrectly](https://wordpress.org/support/topic/ssl-headers-are-displayed-incorrectly/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [1 year, 6 months ago](https://wordpress.org/support/topic/ssl-headers-are-displayed-incorrectly/#post-18257976) * Hi [@jarnovos](https://wordpress.org/support/users/jarnovos/), thx for the answer! * An error about incorrect headers appeared after the last update of the plugin, I understand that this may not be an error, but after checking and convincing that the problem is not with my site, I decided to write a small bug report. * Regarding disabling notifications from the plugin, also thanks for the advice, but I don’t want to do this because the RSS plugin notifies about “bad” plugins, which is extremely useful, and constantly monitoring their status is not always convenient. * Forum: [Themes and Templates](https://wordpress.org/support/forum/themes-and-templates/) In reply to: [[Hueman] WP 6.4.1 crack Hueman theme](https://wordpress.org/support/topic/wp-6-4-1-crack-hueman-theme/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [2 years, 9 months ago](https://wordpress.org/support/topic/wp-6-4-1-crack-hueman-theme/#post-17209414) * I don’t think the problem is with any plugin as the error display is very strange and doesn’t look like plugin incompatibilities. My big concern is that the problem may be both in WP itself and in the hosting (my site runs on my server). But I’m checking it out for now. The closest thing seems to be a problem with the theme, which has not been updated for a very long time compared to WP itself * Forum: [Reviews](https://wordpress.org/support/forum/reviews/) In reply to: [[W3 Total Cache] update 2.2.10 kill site](https://wordpress.org/support/topic/update-2-2-10-kill-site/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [3 years, 6 months ago](https://wordpress.org/support/topic/update-2-2-10-kill-site/#post-16402047) * Hey [@vmarko](https://wordpress.org/support/users/vmarko/)! For the sake of interest, I decided to install the latest version 2.2.12, the problem persists. During this time, I have already found an alternative that works just as well, so I’m unlikely to use this plugin again. * Thanks for your support and good luck with the development! * apply_filters() #4 /home/admin/web/geek-speak.ru/public_html/wp-includes/plugin.php(517): WP_Hook->do_action() #5 /home/admin/web/geek-speak.ru/public_html/wp-admin/includes/template.php(2157): do_action() #6 /home/admin/web/geek-speak.ru/public_html/wp-admin/update.php(53): iframe_foo ``` * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[WP-Recall - Registration, Profile, Commerce & More] Баг после обновления reCapcha](https://wordpress.org/support/topic/%d0%b1%d0%b0%d0%b3-%d0%bf%d0%be%d1%81%d0%bb%d0%b5-%d0%be%d0%b1%d0%bd%d0%be%d0%b2%d0%bb%d0%b5%d0%bd%d0%b8%d1%8f-recapcha/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [4 years, 9 months ago](https://wordpress.org/support/topic/%d0%b1%d0%b0%d0%b3-%d0%bf%d0%be%d1%81%d0%bb%d0%b5-%d0%be%d0%b1%d0%bd%d0%be%d0%b2%d0%bb%d0%b5%d0%bd%d0%b8%d1%8f-recapcha/#post-15031213) * Спасибо, поставил Really Simple Captcha в принципе справляется со своей задачей. Обращался по этому поводу к создателям reCaptcha, ответили, что не тестировали плагины вместе (recapch+wp-recall) по этому интеграция невозможна xD ну в принципе ожидаемый ответ)) Еще есть вопрос по поводу поля пароля при регистрации, перестал отображаться индикатор сложности пароля, постоянно пишет, что пароль не введен. Хотя регистрирует нормально, куда капнуть не подскажите? Заранее спасибо за ответ! * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] how to set security headers correctly?](https://wordpress.org/support/topic/how-to-set-security-headers-correctly/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [4 years, 10 months ago](https://wordpress.org/support/topic/how-to-set-security-headers-correctly/#post-14983703) * And so I solved my problem with security headers, I remembered about this topic. saw the notification letter on my email)) * when using your OWN host, with the HestiaCP site control panel, you need to do the following: Nginx.conf SSL PCI compliance section delete completely, instead write the following: * ``` # SSL PCI compliance ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_dhparam /etc/ssl/dhparam.pem; ssl_ciphers "EECDH+AESGCM:EDH+AESGCM"; ssl_ecdh_curve secp384r1; ssl_session_timeout 10m; ssl_buffer_size 1400; ssl_session_cache shared:SSL:10m; ssl_session_tickets off; ssl_stapling_verify on; resolver DNS1 DNS2 valid=300s ipv6=off; resolver_timeout 5s; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Frame-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header Expect-CT "max-age=7776000, enforce"; add_header Referrer-Policy "no-referrer-when-downgrade"; add_header Content-Security-Policy "upgrade-insecure-requests"; ``` * Apache2.conf In the “Global configuration” section, add the line Include conf- enabled/security.conf, after which we open the security config (/etc/apache2/ conf-enabled/security.conf) and add lines to the very end: * ``` SSLCipherSuite EECDH+AESGCM:EDH+AESGCM # Requires Apache 2.4.36 & OpenSSL 1.1.1 SSLProtocol -all +TLSv1.3 +TLSv1.2 SSLOpenSSLConfCmd Curves X25519:secp521r1:secp384r1:prime256v1 # Older versions # SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 SSLHonorCipherOrder On Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" Header always set X-Frame-Options: "SAMEORIGIN" Header always set X-Content-Type-Options: "nosniff" Header always set X-XSS-Protection "1; mode=block" Header always set Expect-CT "max-age=7776000, enforce" Header always set Referrer-Policy: "no-referrer-when-downgrade" Header always set Content-Security-Policy "upgrade-insecure-requests" # Requires Apache >= 2.4 SSLCompression off SSLUseStapling on SSLStaplingCache "shmcb:logs/stapling-cache(150000)" # Requires Apache >= 2.4.11 SSLSessionTickets Off ``` * ATTENTION, in order for the header settings in Apache to work, you will need to enable headers_mod if you have not already done this, to enable it in the console enter the command: `# a2enmod headers` * Well, in the end, you need to make a change to the .htaccess file, although as far as I understand this was no longer necessary because changes were made at the server level, but still. Looking for a section if it is not there, we add it ourselves, and specify in it the same parameters that were specified in the apache2 security configuration: * ``` Header set Referrer-Policy "no-referrer-when-downgrade" Header set Strict-Transport-Security "max-age=63072000" Header set X-Frame-Options “SAMEORIGIN” Header set X-Content-Type-Options "nosniff" Header set X-XSS-Protection "1; mode=block" Header set Expect-CT "max-age=7776000, enforce" Header set Content-Security-Policy "upgrade-insecure-requests" ``` * restart nginx and apache2 services, all headers will work fine! * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] how to set security headers correctly?](https://wordpress.org/support/topic/how-to-set-security-headers-correctly/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [5 years, 2 months ago](https://wordpress.org/support/topic/how-to-set-security-headers-correctly/#post-14565927) * Hi [@markwolters](https://wordpress.org/support/users/markwolters/)! i use hestia cp, it runs apache2 – web server, nginx – reverse proxy server. In this control panel, there are a little strange rules, .htaccess does not accept header rules( the site crashes with a 500 error), so I had to add them to the configuration of apache2 itself. My site uses caching, so, unfortunately, the alternative method does not work… * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] how to set security headers correctly?](https://wordpress.org/support/topic/how-to-set-security-headers-correctly/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [5 years, 2 months ago](https://wordpress.org/support/topic/how-to-set-security-headers-correctly/#post-14561664) * Hi [@markwolters](https://wordpress.org/support/users/markwolters/)! I am a hosting provider as the web server is running on my pc. I have a suspicion that the rules still work, because the warning in wordress says that the rules are missing in the file .htaccess. How do I check if the headers are doing the right thing? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] how to set security headers correctly?](https://wordpress.org/support/topic/how-to-set-security-headers-correctly/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [5 years, 2 months ago](https://wordpress.org/support/topic/how-to-set-security-headers-correctly/#post-14558102) * Hi [@markwolters](https://wordpress.org/support/users/markwolters/)! The main nginx settings are on my server at /etc/nginx/nginx.conf, I added the server block to the http tag but the problem persists… my nginx.conf: * ``` http { server { add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Content-Security-Policy upgrade-insecure-requests; add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff"; add_header Expect-CT 'enforce; max-age=7776000'; add_header X-Frame-Options "SAMEORIGIN"; } ``` * I am using debian 10, maybe I need to install some additional module? I have installed nginx-extras only. * Forum: [Reviews](https://wordpress.org/support/forum/reviews/) In reply to: [[Ban Hammer] Great plugin!](https://wordpress.org/support/topic/great-plugin-30791/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [5 years, 3 months ago](https://wordpress.org/support/topic/great-plugin-30791/#post-14408660) * ok, this is just a proposal from me, if it can be implemented in the future, it will be great, if not, then we will be content with what we have. Thanks again for the work done! * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Download Manager] Download history is not updated](https://wordpress.org/support/topic/download-history-is-not-updated/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [5 years, 5 months ago](https://wordpress.org/support/topic/download-history-is-not-updated/#post-14151516) * Thx! A simple solution to the problem turned out to be, I’m happy! =) - This reply was modified 5 years, 5 months ago by [Esmertec](https://wordpress.org/support/users/esmertec/). * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[WP-Recall - Registration, Profile, Commerce & More] Подтверждение регистрации на mail.ru](https://wordpress.org/support/topic/%d0%bf%d0%be%d0%b4%d1%82%d0%b2%d0%b5%d1%80%d0%b6%d0%b4%d0%b5%d0%bd%d0%b8%d0%b5-%d1%80%d0%b5%d0%b3%d0%b8%d1%81%d1%82%d1%80%d0%b0%d1%86%d0%b8%d0%b8-%d0%bd%d0%b0-mail-ru/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [6 years, 7 months ago](https://wordpress.org/support/topic/%d0%bf%d0%be%d0%b4%d1%82%d0%b2%d0%b5%d1%80%d0%b6%d0%b4%d0%b5%d0%bd%d0%b8%d0%b5-%d1%80%d0%b5%d0%b3%d0%b8%d1%81%d1%82%d1%80%d0%b0%d1%86%d0%b8%d0%b8-%d0%bd%d0%b0-mail-ru/#post-12294565) * Ок, обращусь в mail.ru. Хостинг тут не причем, т.к. я и являюсь администратором своего хостинга. Письма roundcube (встроенный почтовый сервер) отправляются без проблем. По этому раз не в плагине проблема, дело в сервере mail.ru. * Forum: [Reviews](https://wordpress.org/support/forum/reviews/) In reply to: [[Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)] Works great!](https://wordpress.org/support/topic/works-great-5785/) * Thread Starter [Esmertec](https://wordpress.org/support/users/esmertec/) * (@esmertec) * [7 years, 3 months ago](https://wordpress.org/support/topic/works-great-5785/#post-11478455) * Hi [@rogierlankhorst](https://wordpress.org/support/users/rogierlankhorst/), This is probably not a problem, but I have a separate server, the monitoring of which can work only on http, the easy ssl plugin converts absolutely all my links to https, which is why monitoring gives an error, because it simply does not work at https. * I took your advice, and he helped me, but I hope in new versions of the plugin you will give the opportunity to add links through the building of the plugin itself, and not by editing the file functions.php * ``` function rsssl_exclude_http_url($html) { $html = str_replace("https://www.domain.com", "http://www.domain.com", $html); return $html; } add_filter("rsssl_fixer_output","rsssl_exclude_http_url"); ``` * P.S. My monitoring uses the same domain as the main site, but on port 8000, so it does not cause problems with mixing ssl =) * Thank you for your work and have a great day! I hope my wishes will still appear in future versions of your product 😉 Viewing 14 replies - 1 through 14 (of 14 total)