Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

security-headers

Estrellas1

Forks0

Actualizado15 de junio de 2026 a las 21:59

MU-plugin that adds HTTP security headers to every WordPress response: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, Permissions-Policy, and optional Content-Security-Policy. Also removes WordPress version fingerprinting from HTML head.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

rahlplx

rahlplx/wp-arsenal

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Desarrolladores de softwareOcupaciones informáticas y matemáticas·SOC 15-1252

SKILL.md

readonly

name	security-headers
description	MU-plugin that adds HTTP security headers to every WordPress response: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, Permissions-Policy, and optional Content-Security-Policy. Also removes WordPress version fingerprinting from HTML head.
triggers	["security headers","HTTP headers","HSTS","Content Security Policy","CSP","clickjacking protection","X-Frame-Options"]

Skill: security-headers (MU-plugin)

Adds standard HTTP security headers to all WordPress responses. Works on every page, login screen, and admin panel. No configuration required for basic protection — everything is opt-in for stricter settings.

Deploy

cp scripts/hardening/mu-plugins/security-headers.php \
   /path/to/wp-content/mu-plugins/

Works immediately with safe defaults. No configuration required.

Headers added by default

Header	Value	Protection
`X-Frame-Options`	`SAMEORIGIN`	Clickjacking
`X-Content-Type-Options`	`nosniff`	MIME sniffing
`X-XSS-Protection`	`1; mode=block`	Legacy XSS filter
`Referrer-Policy`	`strict-origin-when-cross-origin`	Referrer leakage
`Permissions-Policy`	`camera=(), microphone=(), geolocation=(), payment=()`	Feature access
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains`	HTTPS enforcement (HTTPS only)

Also removes:

X-Powered-By header (PHP version fingerprinting)
Server header (server software fingerprinting)
WordPress version from <head> (wp_generator tag)

Optional: stricter X-Frame-Options

// wp-arsenal-config.php
define('WP_ARSENAL_X_FRAME', 'DENY');  // prevent all framing (more restrictive)

Optional: Content Security Policy

CSP is off by default because WordPress themes commonly use inline scripts and styles that would be blocked by a strict CSP.

// wp-arsenal-config.php
define('WP_ARSENAL_CSP_ENABLED', true);

// Start with the permissive built-in default, then tighten over time:
define('WP_ARSENAL_CSP_POLICY',
    "default-src 'self'; "
    . "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com; "
    . "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
    . "img-src 'self' data: https:; "
    . "font-src 'self' https://fonts.gstatic.com; "
    . "frame-ancestors 'self';"
);

CSP tip: Use Content-Security-Policy-Report-Only first (report without blocking) to discover what your site needs before enabling enforcement.

Optional: custom HSTS max-age

// wp-arsenal-config.php
define('WP_ARSENAL_HSTS_MAX_AGE', 63072000);  // 2 years
// Or disable HSTS (if you have mixed HTTP/HTTPS content):
define('WP_ARSENAL_HSTS_MAX_AGE', 0);

Warning: HSTS is only sent when WordPress detects an HTTPS connection. Once set with a long max-age, browsers will refuse HTTP connections to your domain for that duration. Only enable after you have permanent HTTPS.

Verify headers are working

curl -sI https://yoursite.com | grep -E "X-Frame|X-Content|Strict|Referrer|Permissions|Content-Security"

Más de este repositorio

mismo repositorio

wp-ci-deploy

rahlplx/wp-arsenal

Deploy a theme, plugin, or wp-content subset to a WordPress server from a CI/CD pipeline, with automatic pre-deploy backup, post-deploy health check, and automatic rollback on failure. Designed for GitHub Actions, GitLab CI, or any pipeline that can run Python.

2026-06-161

wp-woo-audit

rahlplx/wp-arsenal

Security and integrity audit for WooCommerce stores. Checks REST API key scope, payment gateway exposure, webhook HTTPS enforcement, suspicious $0 orders, exposed wc-logs (PII/payment data), and coupon abuse.

2026-06-161

wp-child-theme

rahlplx/wp-arsenal

Scaffold and deploy a WordPress child theme via SSH. Generates style.css, functions.php (with correct parent style enqueueing), and index.php. Supports Kadence, Astra, GeneratePress, Hello Elementor, OceanWP, and any custom parent. Can activate the child theme immediately after creation.

2026-06-161

wp-theme-switch

rahlplx/wp-arsenal

Safely switch WordPress themes via SSH with automatic rollback if the site goes down. Records the previous theme for instant rollback. Verifies HTTP 200 before and after the switch.

2026-06-161

wp-theme-audit

rahlplx/wp-arsenal

Security audit of WordPress themes via SSH. Scans for PHP malware patterns, injected scripts, recently modified files, and unexpected file types. Also checks DB for customizer injections and Elementor postmeta payloads. Use after any attack or before going live with a new/inherited theme.

2026-06-161

elementor-guide

rahlplx/wp-arsenal

Comprehensive guide to building, maintaining, and recovering Elementor-based WordPress sites. Covers the CSS pipeline, global styles (Kit), common post-attack failures and fixes, Pro vs Free features, and integration with Kadence and Hello Elementor themes.

2026-06-161

name	security-headers
description	MU-plugin that adds HTTP security headers to every WordPress response: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, Permissions-Policy, and optional Content-Security-Policy. Also removes WordPress version fingerprinting from HTML head.
triggers	["security headers","HTTP headers","HSTS","Content Security Policy","CSP","clickjacking protection","X-Frame-Options"]

Skill: security-headers (MU-plugin)

Deploy

cp scripts/hardening/mu-plugins/security-headers.php \
   /path/to/wp-content/mu-plugins/

Works immediately with safe defaults. No configuration required.

Headers added by default

Header	Value	Protection
`X-Frame-Options`	`SAMEORIGIN`	Clickjacking
`X-Content-Type-Options`	`nosniff`	MIME sniffing
`X-XSS-Protection`	`1; mode=block`	Legacy XSS filter
`Referrer-Policy`	`strict-origin-when-cross-origin`	Referrer leakage
`Permissions-Policy`	`camera=(), microphone=(), geolocation=(), payment=()`	Feature access
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains`	HTTPS enforcement (HTTPS only)

Also removes:

X-Powered-By header (PHP version fingerprinting)
Server header (server software fingerprinting)
WordPress version from <head> (wp_generator tag)

Optional: stricter X-Frame-Options

// wp-arsenal-config.php
define('WP_ARSENAL_X_FRAME', 'DENY');  // prevent all framing (more restrictive)

Optional: Content Security Policy

CSP is off by default because WordPress themes commonly use inline scripts and styles that would be blocked by a strict CSP.

// wp-arsenal-config.php
define('WP_ARSENAL_CSP_ENABLED', true);

// Start with the permissive built-in default, then tighten over time:
define('WP_ARSENAL_CSP_POLICY',
    "default-src 'self'; "
    . "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com; "
    . "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
    . "img-src 'self' data: https:; "
    . "font-src 'self' https://fonts.gstatic.com; "
    . "frame-ancestors 'self';"
);

CSP tip: Use Content-Security-Policy-Report-Only first (report without blocking) to discover what your site needs before enabling enforcement.

Optional: custom HSTS max-age

// wp-arsenal-config.php
define('WP_ARSENAL_HSTS_MAX_AGE', 63072000);  // 2 years
// Or disable HSTS (if you have mixed HTTP/HTTPS content):
define('WP_ARSENAL_HSTS_MAX_AGE', 0);

Verify headers are working

curl -sI https://yoursite.com | grep -E "X-Frame|X-Content|Strict|Referrer|Permissions|Content-Security"