菜单
MU-plugin that adds HTTP security headers to every WordPress response: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, Permissions-Policy, and optional Content-Security-Policy. Also removes WordPress version fingerprinting from HTML head.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Deploy a theme, plugin, or wp-content subset to a WordPress server from a CI/CD pipeline, with automatic pre-deploy backup, post-deploy health check, and automatic rollback on failure. Designed for GitHub Actions, GitLab CI, or any pipeline that can run Python.
Security and integrity audit for WooCommerce stores. Checks REST API key scope, payment gateway exposure, webhook HTTPS enforcement, suspicious $0 orders, exposed wc-logs (PII/payment data), and coupon abuse.
Scaffold and deploy a WordPress child theme via SSH. Generates style.css, functions.php (with correct parent style enqueueing), and index.php. Supports Kadence, Astra, GeneratePress, Hello Elementor, OceanWP, and any custom parent. Can activate the child theme immediately after creation.
Safely switch WordPress themes via SSH with automatic rollback if the site goes down. Records the previous theme for instant rollback. Verifies HTTP 200 before and after the switch.
Security audit of WordPress themes via SSH. Scans for PHP malware patterns, injected scripts, recently modified files, and unexpected file types. Also checks DB for customizer injections and Elementor postmeta payloads. Use after any attack or before going live with a new/inherited theme.
Comprehensive guide to building, maintaining, and recovering Elementor-based WordPress sites. Covers the CSS pipeline, global styles (Kit), common post-attack failures and fixes, Pro vs Free features, and integration with Kadence and Hello Elementor themes.
| name | security-headers |
| description | MU-plugin that adds HTTP security headers to every WordPress response: X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, Permissions-Policy, and optional Content-Security-Policy. Also removes WordPress version fingerprinting from HTML head. |
| triggers | ["security headers","HTTP headers","HSTS","Content Security Policy","CSP","clickjacking protection","X-Frame-Options"] |
Adds standard HTTP security headers to all WordPress responses. Works on every page, login screen, and admin panel. No configuration required for basic protection — everything is opt-in for stricter settings.
cp scripts/hardening/mu-plugins/security-headers.php \
/path/to/wp-content/mu-plugins/
Works immediately with safe defaults. No configuration required.
| Header | Value | Protection |
|---|---|---|
X-Frame-Options | SAMEORIGIN | Clickjacking |
X-Content-Type-Options | nosniff | MIME sniffing |
X-XSS-Protection | 1; mode=block | Legacy XSS filter |
Referrer-Policy | strict-origin-when-cross-origin | Referrer leakage |
Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=() | Feature access |
Strict-Transport-Security | max-age=31536000; includeSubDomains | HTTPS enforcement (HTTPS only) |
Also removes:
X-Powered-By header (PHP version fingerprinting)Server header (server software fingerprinting)<head> (wp_generator tag)// wp-arsenal-config.php
define('WP_ARSENAL_X_FRAME', 'DENY'); // prevent all framing (more restrictive)
CSP is off by default because WordPress themes commonly use inline scripts and styles that would be blocked by a strict CSP.
// wp-arsenal-config.php
define('WP_ARSENAL_CSP_ENABLED', true);
// Start with the permissive built-in default, then tighten over time:
define('WP_ARSENAL_CSP_POLICY',
"default-src 'self'; "
. "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com; "
. "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
. "img-src 'self' data: https:; "
. "font-src 'self' https://fonts.gstatic.com; "
. "frame-ancestors 'self';"
);
CSP tip: Use Content-Security-Policy-Report-Only first (report without blocking)
to discover what your site needs before enabling enforcement.
// wp-arsenal-config.php
define('WP_ARSENAL_HSTS_MAX_AGE', 63072000); // 2 years
// Or disable HSTS (if you have mixed HTTP/HTTPS content):
define('WP_ARSENAL_HSTS_MAX_AGE', 0);
Warning: HSTS is only sent when WordPress detects an HTTPS connection. Once
set with a long max-age, browsers will refuse HTTP connections to your domain
for that duration. Only enable after you have permanent HTTPS.
curl -sI https://yoursite.com | grep -E "X-Frame|X-Content|Strict|Referrer|Permissions|Content-Security"