Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

security-headers

Estrelas1

Forks0

Atualizado15 de junho de 2026 às 21:59

MU-plugin that adds HTTP security headers to every WordPress response: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, Permissions-Policy, and optional Content-Security-Policy. Also removes WordPress version fingerprinting from HTML head.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

rahlplx

rahlplx/wp-arsenal

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Desenvolvedores de softwareInformática e Matemática·SOC 15-1252

SKILL.md

readonly

name	security-headers
description	MU-plugin that adds HTTP security headers to every WordPress response: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, Permissions-Policy, and optional Content-Security-Policy. Also removes WordPress version fingerprinting from HTML head.
triggers	["security headers","HTTP headers","HSTS","Content Security Policy","CSP","clickjacking protection","X-Frame-Options"]

Skill: security-headers (MU-plugin)

Adds standard HTTP security headers to all WordPress responses. Works on every page, login screen, and admin panel. No configuration required for basic protection — everything is opt-in for stricter settings.

Deploy

cp scripts/hardening/mu-plugins/security-headers.php \
   /path/to/wp-content/mu-plugins/

Works immediately with safe defaults. No configuration required.

Headers added by default

Header	Value	Protection
`X-Frame-Options`	`SAMEORIGIN`	Clickjacking
`X-Content-Type-Options`	`nosniff`	MIME sniffing
`X-XSS-Protection`	`1; mode=block`	Legacy XSS filter
`Referrer-Policy`	`strict-origin-when-cross-origin`	Referrer leakage
`Permissions-Policy`	`camera=(), microphone=(), geolocation=(), payment=()`	Feature access
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains`	HTTPS enforcement (HTTPS only)

Also removes:

X-Powered-By header (PHP version fingerprinting)
Server header (server software fingerprinting)
WordPress version from <head> (wp_generator tag)

Optional: stricter X-Frame-Options

// wp-arsenal-config.php
define('WP_ARSENAL_X_FRAME', 'DENY');  // prevent all framing (more restrictive)

Optional: Content Security Policy

CSP is off by default because WordPress themes commonly use inline scripts and styles that would be blocked by a strict CSP.

// wp-arsenal-config.php
define('WP_ARSENAL_CSP_ENABLED', true);

// Start with the permissive built-in default, then tighten over time:
define('WP_ARSENAL_CSP_POLICY',
    "default-src 'self'; "
    . "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com; "
    . "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
    . "img-src 'self' data: https:; "
    . "font-src 'self' https://fonts.gstatic.com; "
    . "frame-ancestors 'self';"
);

CSP tip: Use Content-Security-Policy-Report-Only first (report without blocking) to discover what your site needs before enabling enforcement.

Optional: custom HSTS max-age

// wp-arsenal-config.php
define('WP_ARSENAL_HSTS_MAX_AGE', 63072000);  // 2 years
// Or disable HSTS (if you have mixed HTTP/HTTPS content):
define('WP_ARSENAL_HSTS_MAX_AGE', 0);

Warning: HSTS is only sent when WordPress detects an HTTPS connection. Once set with a long max-age, browsers will refuse HTTP connections to your domain for that duration. Only enable after you have permanent HTTPS.

Verify headers are working

curl -sI https://yoursite.com | grep -E "X-Frame|X-Content|Strict|Referrer|Permissions|Content-Security"

Mais deste repositório

mesmo repositório

wp-ci-deploy

rahlplx/wp-arsenal

Deploy a theme, plugin, or wp-content subset to a WordPress server from a CI/CD pipeline, with automatic pre-deploy backup, post-deploy health check, and automatic rollback on failure. Designed for GitHub Actions, GitLab CI, or any pipeline that can run Python.

2026-06-161

wp-woo-audit

rahlplx/wp-arsenal

Security and integrity audit for WooCommerce stores. Checks REST API key scope, payment gateway exposure, webhook HTTPS enforcement, suspicious $0 orders, exposed wc-logs (PII/payment data), and coupon abuse.

2026-06-161

wp-child-theme

rahlplx/wp-arsenal

Scaffold and deploy a WordPress child theme via SSH. Generates style.css, functions.php (with correct parent style enqueueing), and index.php. Supports Kadence, Astra, GeneratePress, Hello Elementor, OceanWP, and any custom parent. Can activate the child theme immediately after creation.

2026-06-161

wp-theme-switch

rahlplx/wp-arsenal

Safely switch WordPress themes via SSH with automatic rollback if the site goes down. Records the previous theme for instant rollback. Verifies HTTP 200 before and after the switch.

2026-06-161

wp-theme-audit

rahlplx/wp-arsenal

Security audit of WordPress themes via SSH. Scans for PHP malware patterns, injected scripts, recently modified files, and unexpected file types. Also checks DB for customizer injections and Elementor postmeta payloads. Use after any attack or before going live with a new/inherited theme.

2026-06-161

elementor-guide

rahlplx/wp-arsenal

Comprehensive guide to building, maintaining, and recovering Elementor-based WordPress sites. Covers the CSS pipeline, global styles (Kit), common post-attack failures and fixes, Pro vs Free features, and integration with Kadence and Hello Elementor themes.

2026-06-161

name	security-headers
description	MU-plugin that adds HTTP security headers to every WordPress response: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, Permissions-Policy, and optional Content-Security-Policy. Also removes WordPress version fingerprinting from HTML head.
triggers	["security headers","HTTP headers","HSTS","Content Security Policy","CSP","clickjacking protection","X-Frame-Options"]

Skill: security-headers (MU-plugin)

Deploy

cp scripts/hardening/mu-plugins/security-headers.php \
   /path/to/wp-content/mu-plugins/

Works immediately with safe defaults. No configuration required.

Headers added by default

Header	Value	Protection
`X-Frame-Options`	`SAMEORIGIN`	Clickjacking
`X-Content-Type-Options`	`nosniff`	MIME sniffing
`X-XSS-Protection`	`1; mode=block`	Legacy XSS filter
`Referrer-Policy`	`strict-origin-when-cross-origin`	Referrer leakage
`Permissions-Policy`	`camera=(), microphone=(), geolocation=(), payment=()`	Feature access
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains`	HTTPS enforcement (HTTPS only)

Also removes:

X-Powered-By header (PHP version fingerprinting)
Server header (server software fingerprinting)
WordPress version from <head> (wp_generator tag)

Optional: stricter X-Frame-Options

// wp-arsenal-config.php
define('WP_ARSENAL_X_FRAME', 'DENY');  // prevent all framing (more restrictive)

Optional: Content Security Policy

CSP is off by default because WordPress themes commonly use inline scripts and styles that would be blocked by a strict CSP.

// wp-arsenal-config.php
define('WP_ARSENAL_CSP_ENABLED', true);

// Start with the permissive built-in default, then tighten over time:
define('WP_ARSENAL_CSP_POLICY',
    "default-src 'self'; "
    . "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com; "
    . "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
    . "img-src 'self' data: https:; "
    . "font-src 'self' https://fonts.gstatic.com; "
    . "frame-ancestors 'self';"
);

CSP tip: Use Content-Security-Policy-Report-Only first (report without blocking) to discover what your site needs before enabling enforcement.

Optional: custom HSTS max-age

// wp-arsenal-config.php
define('WP_ARSENAL_HSTS_MAX_AGE', 63072000);  // 2 years
// Or disable HSTS (if you have mixed HTTP/HTTPS content):
define('WP_ARSENAL_HSTS_MAX_AGE', 0);

Verify headers are working

curl -sI https://yoursite.com | grep -E "X-Frame|X-Content|Strict|Referrer|Permissions|Content-Security"