WordPress.org
Get WordPress

Plugin Directory

Changeset 3420349


Ignore:
Timestamp:
12/15/2025 04:20:35 PM (2 months ago)
Author:
kevp75
Message:

fix up some suggestions from plugin checker; remove deprecated and remvoed attrs from permissions; add 9 new ones;

Location:
security-header-generator/trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • security-header-generator/trunk/languages/security-header-generator.pot

    r3420274 r3420349  
    77"Content-Type: text/plain; charset=UTF-8\n"
    88"Content-Transfer-Encoding: 8bit\n"
    9 "POT-Creation-Date: 2025-12-15 15:14+0000\n"
     9"POT-Creation-Date: 2025-12-15 16:18+0000\n"
    1010"X-Poedit-Basepath: ..\n"
    1111"X-Poedit-KeywordsList: __;_e;_ex:1,2c;_n:1,2;_n_noop:1,2;_nx:1,2,4c;_nx_noop:1,2,3c;_x:1,2c;esc_attr__;esc_attr_e;esc_attr_x:1,2c;esc_html__;esc_html_e;esc_html_x:1,2c\n"
    … …  
    3232
    3333#: source/work/common.php:140
    34 msgid "<h3>PHP Upgrade Notice</h3><p>To maintain the security standards of the <strong>Security Header Generator</strong> plugin this will be the final version that supports PHP versions lower than 8.1. Your site must be upgraded in order to update the plugin to future versions.</p><p>Please see here for up to date PHP version information: <a href='https://www.php.net/supported-versions.php' target='_blank'>https://www.php.net/supported-versions.php</a></p>"
     34msgid "PHP Upgrade Notice"
     35msgstr ""
     36
     37#: source/work/common.php:141
     38msgid "To maintain the security standards of the Security Header Generator plugin this will be the final version that supports PHP versions lower than 8.2. Your site must be upgraded in order to update the plugin to future versions."
     39msgstr ""
     40
     41#: source/work/common.php:142
     42msgid "Please see here for up to date PHP version information: https://www.php.net/supported-versions.php"
    3543msgstr ""
    3644
    … …  
    539547msgstr ""
    540548
    541 #: source/work/inc/kcp-cspgen-common.php:58
    542 msgid "Ambient Light Sensor"
    543 msgstr ""
    544 
    545 #: source/work/inc/kcp-cspgen-common.php:59
    546 msgid "Controls whether the current document is allowed to gather information about the amount of light in the environment around the device through the AmbientLightSensor interface."
    547 msgstr ""
    548 
    549 #: source/work/inc/kcp-cspgen-common.php:63
     549#: source/work/inc/kcp-cspgen-common.php:65
    550550msgid "Autoplay"
    551551msgstr ""
    552552
    553 #: source/work/inc/kcp-cspgen-common.php:64
     553#: source/work/inc/kcp-cspgen-common.php:66
    554554msgid "Controls whether the current document is allowed to autoplay media requested through the HTMLMediaElement interface. When this policy is disabled and there were no user gestures, the Promise returned by HTMLMediaElement.play() will reject with a DOMException. The autoplay attribute on &lt;audio&gt; and &lt;video&gt; elements will be ignored."
    555555msgstr ""
    556556
    557 #: source/work/inc/kcp-cspgen-common.php:68
     557#: source/work/inc/kcp-cspgen-common.php:70
     558msgid "Bluetooth"
     559msgstr ""
     560
     561#: source/work/inc/kcp-cspgen-common.php:71
     562msgid "Controls whether the use of the Web Bluetooth API is allowed. When this policy is disabled, the methods of the Bluetooth object returned by Navigator.bluetooth will either return false or reject the returned Promise with a SecurityError DOMException."
     563msgstr ""
     564
     565#: source/work/inc/kcp-cspgen-common.php:75
    558566msgid "Camera"
    559567msgstr ""
    560568
    561 #: source/work/inc/kcp-cspgen-common.php:69
     569#: source/work/inc/kcp-cspgen-common.php:76
    562570msgid "Controls whether the current document is allowed to use video input devices. When this policy is disabled, the Promise returned by getUserMedia() will reject with a NotAllowedError DOMException."
    563571msgstr ""
    564572
    565 #: source/work/inc/kcp-cspgen-common.php:73
     573#: source/work/inc/kcp-cspgen-common.php:80
     574msgid "Captured Surface Control"
     575msgstr ""
     576
     577#: source/work/inc/kcp-cspgen-common.php:81
     578msgid "Controls whether the Captured Surface Control feature can be used to programmatically manipulate a display surface being captured (such as a browser tab or window), including scrolling and zooming."
     579msgstr ""
     580
     581#: source/work/inc/kcp-cspgen-common.php:85
     582msgid "Compute Pressure"
     583msgstr ""
     584
     585#: source/work/inc/kcp-cspgen-common.php:86
     586msgid "Controls access to the Compute Pressure API, which allows monitoring of compute pressure (CPU, GPU) on the device."
     587msgstr ""
     588
     589#: source/work/inc/kcp-cspgen-common.php:90
     590msgid "Cross Origin Isolated"
     591msgstr ""
     592
     593#: source/work/inc/kcp-cspgen-common.php:91
     594msgid "Controls whether the document is cross-origin isolated, enabling certain powerful features like SharedArrayBuffer and high-precision timers."
     595msgstr ""
     596
     597#: source/work/inc/kcp-cspgen-common.php:95
     598msgid "Deferred Fetch"
     599msgstr ""
     600
     601#: source/work/inc/kcp-cspgen-common.php:96
     602msgid "Controls whether the current document is allowed to use the fetchLater() API to defer fetch requests until after the document is unloaded."
     603msgstr ""
     604
     605#: source/work/inc/kcp-cspgen-common.php:100
     606msgid "Deferred Fetch Minimal"
     607msgstr ""
     608
     609#: source/work/inc/kcp-cspgen-common.php:101
     610msgid "Controls whether the current document is allowed to use the fetchLater() API with minimal quota restrictions."
     611msgstr ""
     612
     613#: source/work/inc/kcp-cspgen-common.php:105
    566614msgid "Display Capture"
    567615msgstr ""
    568616
    569 #: source/work/inc/kcp-cspgen-common.php:74
     617#: source/work/inc/kcp-cspgen-common.php:106
    570618msgid "Controls whether or not the current document is permitted to use the getDisplayMedia() method to capture screen contents. When this policy is disabled, the promise returned by getDisplayMedia() will reject with a NotAllowedError if permission is not obtained to capture the display's contents."
    571619msgstr ""
    572620
    573 #: source/work/inc/kcp-cspgen-common.php:78
     621#: source/work/inc/kcp-cspgen-common.php:110
    574622msgid "Encrypted Media"
    575623msgstr ""
    576624
    577 #: source/work/inc/kcp-cspgen-common.php:79
     625#: source/work/inc/kcp-cspgen-common.php:111
    578626msgid "Controls whether the current document is allowed to use the Encrypted Media Extensions API (EME). When this policy is disabled, the Promise returned by Navigator.requestMediaKeySystemAccess() will reject with a DOMException."
    579627msgstr ""
    580628
    581 #: source/work/inc/kcp-cspgen-common.php:83
     629#: source/work/inc/kcp-cspgen-common.php:115
    582630msgid "Full Screen"
    583631msgstr ""
    584632
    585 #: source/work/inc/kcp-cspgen-common.php:84
     633#: source/work/inc/kcp-cspgen-common.php:116
    586634msgid "Controls whether the current document is allowed to use Element.requestFullScreen(). When this policy is disabled, the returned Promise rejects with a TypeError."
    587635msgstr ""
    588636
    589 #: source/work/inc/kcp-cspgen-common.php:88
     637#: source/work/inc/kcp-cspgen-common.php:120
    590638msgid "Geo Location"
    591639msgstr ""
    592640
    593 #: source/work/inc/kcp-cspgen-common.php:89
     641#: source/work/inc/kcp-cspgen-common.php:121
    594642msgid "Controls whether the current document is allowed to use the Geolocation Interface. When this policy is disabled, calls to getCurrentPosition() and watchPosition() will cause those functions' callbacks to be invoked with a GeolocationPositionError code of PERMISSION_DENIED"
    595643msgstr ""
    596644
    597 #: source/work/inc/kcp-cspgen-common.php:93
     645#: source/work/inc/kcp-cspgen-common.php:125
    598646msgid "Gyroscope"
    599647msgstr ""
    600648
    601 #: source/work/inc/kcp-cspgen-common.php:94
     649#: source/work/inc/kcp-cspgen-common.php:126
    602650msgid "Controls whether the current document is allowed to gather information about the orientation of the device through the Gyroscope interface"
    603651msgstr ""
    604652
    605 #: source/work/inc/kcp-cspgen-common.php:99
     653#: source/work/inc/kcp-cspgen-common.php:131
    606654msgid "Human Interface Device"
    607655msgstr ""
    608656
    609 #: source/work/inc/kcp-cspgen-common.php:100
     657#: source/work/inc/kcp-cspgen-common.php:132
    610658msgid "Controls whether the current document is allowed to use the WebHID API to connect to uncommon or exotic human interface devices such as alternative keyboards or gamepads."
    611659msgstr ""
    612660
    613 #: source/work/inc/kcp-cspgen-common.php:104
     661#: source/work/inc/kcp-cspgen-common.php:136
    614662msgid "Identity Credentials Get"
    615663msgstr ""
    616664
    617 #: source/work/inc/kcp-cspgen-common.php:105
     665#: source/work/inc/kcp-cspgen-common.php:137
    618666msgid "Controls whether the current document is allowed to use the Federated Credential Management API (FedCM), and more specifically the navigator.credentials.get() method with an identity option."
    619667msgstr ""
    620668
    621 #: source/work/inc/kcp-cspgen-common.php:109
     669#: source/work/inc/kcp-cspgen-common.php:141
    622670msgid "Idle Detection"
    623671msgstr ""
    624672
    625 #: source/work/inc/kcp-cspgen-common.php:110
     673#: source/work/inc/kcp-cspgen-common.php:142
    626674msgid "Controls whether the current document is allowed to use the Idle Detection API to detect when users are interacting with their devices, for example to report \"available\"/\"away\" status in chat applications."
    627675msgstr ""
    628676
    629 #: source/work/inc/kcp-cspgen-common.php:115
    630 msgid "Magnetometer"
    631 msgstr ""
    632 
    633 #: source/work/inc/kcp-cspgen-common.php:116
    634 msgid "Controls whether the current document is allowed to gather information about the orientation of the device through the Magnetometer interface"
    635 msgstr ""
    636 
    637 #: source/work/inc/kcp-cspgen-common.php:120
     677#: source/work/inc/kcp-cspgen-common.php:154
    638678msgid "Microphone"
    639679msgstr ""
    640680
    641 #: source/work/inc/kcp-cspgen-common.php:121
     681#: source/work/inc/kcp-cspgen-common.php:155
    642682msgid "Controls whether the current document is allowed to use audio input devices. When this policy is disabled, the Promise returned by MediaDevices.getUserMedia() will reject with a NotAllowedError."
    643683msgstr ""
    644684
    645 #: source/work/inc/kcp-cspgen-common.php:125
     685#: source/work/inc/kcp-cspgen-common.php:159
    646686msgid "MIDI"
    647687msgstr ""
    648688
    649 #: source/work/inc/kcp-cspgen-common.php:126
     689#: source/work/inc/kcp-cspgen-common.php:160
    650690msgid "Controls whether the current document is allowed to use the Web MIDI API. When this policy is disabled, the Promise returned by Navigator.requestMIDIAccess() will reject with a DOMException"
    651691msgstr ""
    652692
    653 #: source/work/inc/kcp-cspgen-common.php:130
     693#: source/work/inc/kcp-cspgen-common.php:164
     694msgid "OTP Credentials"
     695msgstr ""
     696
     697#: source/work/inc/kcp-cspgen-common.php:165
     698msgid "Controls whether the current document is allowed to use the WebOTP API to request a one-time password (OTP) from a specially-formatted SMS message sent by the app's server."
     699msgstr ""
     700
     701#: source/work/inc/kcp-cspgen-common.php:169
    654702msgid "Payment"
    655703msgstr ""
    656704
    657 #: source/work/inc/kcp-cspgen-common.php:131
     705#: source/work/inc/kcp-cspgen-common.php:170
    658706msgid "Controls whether the current document is allowed to use the Payment Request API. When this policy is enabled, the PaymentRequest() constructor will throw a SecurityError DOMException"
    659707msgstr ""
    660708
    661 #: source/work/inc/kcp-cspgen-common.php:135
     709#: source/work/inc/kcp-cspgen-common.php:174
    662710msgid "Picture in Picture"
    663711msgstr ""
    664712
    665 #: source/work/inc/kcp-cspgen-common.php:136
     713#: source/work/inc/kcp-cspgen-common.php:175
    666714msgid "Controls whether the current document is allowed to play a video in a Picture-in-Picture mode via the corresponding API"
    667715msgstr ""
    668716
    669 #: source/work/inc/kcp-cspgen-common.php:140
    670 msgid "Publicket Credentials Create"
    671 msgstr ""
    672 
    673 #: source/work/inc/kcp-cspgen-common.php:141
     717#: source/work/inc/kcp-cspgen-common.php:179
     718msgid "Publickey Credentials Create"
     719msgstr ""
     720
     721#: source/work/inc/kcp-cspgen-common.php:180
    674722msgid "Controls whether the current document is allowed to use the Web Authentication API to create new WebAuthn credentials, i.e., via navigator.credentials.create({publicKey})."
    675723msgstr ""
    676724
    677 #: source/work/inc/kcp-cspgen-common.php:145
    678 msgid "Publicket Credentials Get"
    679 msgstr ""
    680 
    681 #: source/work/inc/kcp-cspgen-common.php:146
     725#: source/work/inc/kcp-cspgen-common.php:184
     726msgid "Publickey Credentials Get"
     727msgstr ""
     728
     729#: source/work/inc/kcp-cspgen-common.php:185
    682730msgid "Controls whether the current document is allowed to use the Web Authentication API to retrieve already stored public-key credentials, i.e. via navigator.credentials.get({publicKey: ..., ...})"
    683731msgstr ""
    684732
    685 #: source/work/inc/kcp-cspgen-common.php:150
     733#: source/work/inc/kcp-cspgen-common.php:189
    686734msgid "Screen Wake Lock"
    687735msgstr ""
    688736
    689 #: source/work/inc/kcp-cspgen-common.php:151
     737#: source/work/inc/kcp-cspgen-common.php:190
    690738msgid "Controls whether the current document is allowed to use Screen Wake Lock API to indicate that the device should not dim or turn off the screen."
    691739msgstr ""
    692740
    693 #: source/work/inc/kcp-cspgen-common.php:155
     741#: source/work/inc/kcp-cspgen-common.php:194
    694742msgid "Serial"
    695743msgstr ""
    696744
    697 #: source/work/inc/kcp-cspgen-common.php:156
     745#: source/work/inc/kcp-cspgen-common.php:195
    698746msgid "Controls whether the current document is allowed to use the Web Serial API to communicate with serial devices, either directly connected via a serial port, or via USB or Bluetooth devices emulating a serial port."
    699747msgstr ""
    700748
    701 #: source/work/inc/kcp-cspgen-common.php:160
    702 msgid "Sync XHR"
    703 msgstr ""
    704 
    705 #: source/work/inc/kcp-cspgen-common.php:161
    706 msgid "Controls whether the current document is allowed to make synchronous XMLHttpRequest requests"
    707 msgstr ""
    708 
    709 #: source/work/inc/kcp-cspgen-common.php:165
     749#: source/work/inc/kcp-cspgen-common.php:199
     750msgid "Storage Access"
     751msgstr ""
     752
     753#: source/work/inc/kcp-cspgen-common.php:200
     754msgid "Controls whether a document loaded in a third-party context (i.e. embedded in an &lt;iframe&gt;) is allowed to use the Storage Access API to request access to unpartitioned cookies."
     755msgstr ""
     756
     757#: source/work/inc/kcp-cspgen-common.php:211
    710758msgid "USB"
    711759msgstr ""
    712760
    713 #: source/work/inc/kcp-cspgen-common.php:166
     761#: source/work/inc/kcp-cspgen-common.php:212
    714762msgid "Controls whether the current document is allowed to use the WebUSB API"
    715763msgstr ""
    716764
    717 #: source/work/inc/kcp-cspgen-common.php:170
     765#: source/work/inc/kcp-cspgen-common.php:216
    718766msgid "Web Share"
    719767msgstr ""
    720768
    721 #: source/work/inc/kcp-cspgen-common.php:171
     769#: source/work/inc/kcp-cspgen-common.php:217
    722770msgid "Controls whether the current document is allowed to use the Navigator.share() method of the Web Share API to share text, links, images, and other content to arbitrary destinations of the user's choice."
    723771msgstr ""
    724772
    725 #: source/work/inc/kcp-cspgen-common.php:175
     773#: source/work/inc/kcp-cspgen-common.php:221
     774msgid "Window Management"
     775msgstr ""
     776
     777#: source/work/inc/kcp-cspgen-common.php:222
     778msgid "Controls whether the current document is allowed to use the Window Management API to manage windows on multiple displays."
     779msgstr ""
     780
     781#: source/work/inc/kcp-cspgen-common.php:226
    726782msgid "XR Spatial Tracking"
    727783msgstr ""
    728784
    729 #: source/work/inc/kcp-cspgen-common.php:176
     785#: source/work/inc/kcp-cspgen-common.php:227
    730786msgid "Controls whether or not the current document is allowed to use the WebXR Device API to interact with a WebXR session"
    731787msgstr ""
    732788
    733 #: source/work/inc/kcp-cspgen-common.php:207
     789#: source/work/inc/kcp-cspgen-common.php:258
    734790msgid "Base URI"
    735791msgstr ""
    736792
    737 #: source/work/inc/kcp-cspgen-common.php:208
     793#: source/work/inc/kcp-cspgen-common.php:259
    738794msgid "Restricts the URLs which can be used in a document's <base> element. If this value is absent, then any URI is allowed."
    739795msgstr ""
    740796
    741 #: source/work/inc/kcp-cspgen-common.php:212
     797#: source/work/inc/kcp-cspgen-common.php:263
    742798msgid "Child Source"
    743799msgstr ""
    744800
    745 #: source/work/inc/kcp-cspgen-common.php:213
     801#: source/work/inc/kcp-cspgen-common.php:264
    746802msgid "Defines the valid sources for web workers and nested browsing contexts loaded using elements such as &lt;frame&gt; and &lt;iframe&gt;."
    747803msgstr ""
    748804
    749 #: source/work/inc/kcp-cspgen-common.php:217
     805#: source/work/inc/kcp-cspgen-common.php:268
    750806msgid "Connect/Ajax/XHR Source"
    751807msgstr ""
    752808
    753 #: source/work/inc/kcp-cspgen-common.php:218
     809#: source/work/inc/kcp-cspgen-common.php:269
    754810msgid "Restricts the URLs which can be loaded using script interfaces"
    755811msgstr ""
    756812
    757 #: source/work/inc/kcp-cspgen-common.php:222
     813#: source/work/inc/kcp-cspgen-common.php:273
    758814msgid "Default Source"
    759815msgstr ""
    760816
    761 #: source/work/inc/kcp-cspgen-common.php:223
     817#: source/work/inc/kcp-cspgen-common.php:274
    762818msgid "Serves as a fallback for the other fetch directives."
    763819msgstr ""
    764820
    765 #: source/work/inc/kcp-cspgen-common.php:227
     821#: source/work/inc/kcp-cspgen-common.php:278
    766822msgid "Font Source"
    767823msgstr ""
    768824
    769 #: source/work/inc/kcp-cspgen-common.php:228
     825#: source/work/inc/kcp-cspgen-common.php:279
    770826msgid "Specifies valid sources for fonts loaded using @font-face."
    771827msgstr ""
    772828
    773 #: source/work/inc/kcp-cspgen-common.php:232
     829#: source/work/inc/kcp-cspgen-common.php:283
    774830msgid "Form Action"
    775831msgstr ""
    776832
    777 #: source/work/inc/kcp-cspgen-common.php:233
     833#: source/work/inc/kcp-cspgen-common.php:284
    778834msgid "Restricts the URLs which can be used as the target of a form submissions from a given context."
    779835msgstr ""
    780836
    781 #: source/work/inc/kcp-cspgen-common.php:237
     837#: source/work/inc/kcp-cspgen-common.php:288
    782838msgid "Frame Source"
    783839msgstr ""
    784840
    785 #: source/work/inc/kcp-cspgen-common.php:238
     841#: source/work/inc/kcp-cspgen-common.php:289
    786842msgid "Specifies valid sources for nested browsing contexts loading using elements such as &lt;frame&gt; and &lt;iframe&gt;."
    787843msgstr ""
    788844
    789 #: source/work/inc/kcp-cspgen-common.php:242
     845#: source/work/inc/kcp-cspgen-common.php:293
    790846msgid "Frame Ancestors"
    791847msgstr ""
    792848
    793 #: source/work/inc/kcp-cspgen-common.php:243
     849#: source/work/inc/kcp-cspgen-common.php:294
    794850msgid "Specifies valid parents that may embed a page using &lt;frame&gt;, &lt;iframe&gt;, &lt;object&gt;, &lt;embed&gt;, or &lt;applet&gt;."
    795851msgstr ""
    796852
    797 #: source/work/inc/kcp-cspgen-common.php:247
     853#: source/work/inc/kcp-cspgen-common.php:298
    798854msgid "Image Source"
    799855msgstr ""
    800856
    801 #: source/work/inc/kcp-cspgen-common.php:248
     857#: source/work/inc/kcp-cspgen-common.php:299
    802858msgid "Specifies valid sources of images and favicons."
    803859msgstr ""
    804860
    805 #: source/work/inc/kcp-cspgen-common.php:252
     861#: source/work/inc/kcp-cspgen-common.php:303
    806862msgid "Manifest Source"
    807863msgstr ""
    808864
    809 #: source/work/inc/kcp-cspgen-common.php:253
     865#: source/work/inc/kcp-cspgen-common.php:304
    810866msgid "Specifies valid sources of application manifest files."
    811867msgstr ""
    812868
    813 #: source/work/inc/kcp-cspgen-common.php:257
     869#: source/work/inc/kcp-cspgen-common.php:308
    814870msgid "Media Source"
    815871msgstr ""
    816872
    817 #: source/work/inc/kcp-cspgen-common.php:258
     873#: source/work/inc/kcp-cspgen-common.php:309
    818874msgid "Specifies valid sources for loading media using the &lt;audio&gt; , &lt;video&gt; and &lt;track&gt; elements."
    819875msgstr ""
    820876
    821 #: source/work/inc/kcp-cspgen-common.php:262
     877#: source/work/inc/kcp-cspgen-common.php:313
    822878msgid "Object Source"
    823879msgstr ""
    824880
    825 #: source/work/inc/kcp-cspgen-common.php:263
     881#: source/work/inc/kcp-cspgen-common.php:314
    826882msgid "Specifies valid sources for the &lt;object&gt;, &lt;embed&gt;, and &lt;applet&gt; elements."
    827883msgstr ""
    828884
    829 #: source/work/inc/kcp-cspgen-common.php:267
     885#: source/work/inc/kcp-cspgen-common.php:318
    830886msgid "Sandbox"
    831887msgstr ""
    832888
    833 #: source/work/inc/kcp-cspgen-common.php:268
     889#: source/work/inc/kcp-cspgen-common.php:319
    834890msgid "Applies restrictions to a page's actions including preventing popups, preventing the execution of plugins and scripts, and enforcing a same-origin policy. Please see here for more information: <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox\" target=\"_blank\">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox</a>"
    835891msgstr ""
    836892
    837 #: source/work/inc/kcp-cspgen-common.php:272
     893#: source/work/inc/kcp-cspgen-common.php:323
    838894msgid "Script Source"
    839895msgstr ""
    840896
    841 #: source/work/inc/kcp-cspgen-common.php:273
     897#: source/work/inc/kcp-cspgen-common.php:324
    842898msgid "Specifies valid sources for JavaScript."
    843899msgstr ""
    844900
    845 #: source/work/inc/kcp-cspgen-common.php:277
     901#: source/work/inc/kcp-cspgen-common.php:328
    846902msgid "Script Source Elements"
    847903msgstr ""
    848904
    849 #: source/work/inc/kcp-cspgen-common.php:278
     905#: source/work/inc/kcp-cspgen-common.php:329
    850906msgid "Specifies valid sources for JavaScript &lt;script&gt; elements."
    851907msgstr ""
    852908
    853 #: source/work/inc/kcp-cspgen-common.php:282
     909#: source/work/inc/kcp-cspgen-common.php:333
    854910msgid "Script Source Attributes"
    855911msgstr ""
    856912
    857 #: source/work/inc/kcp-cspgen-common.php:283
     913#: source/work/inc/kcp-cspgen-common.php:334
    858914msgid "Specifies valid sources for JavaScript inline event handlers."
    859915msgstr ""
    860916
    861 #: source/work/inc/kcp-cspgen-common.php:287
     917#: source/work/inc/kcp-cspgen-common.php:338
    862918msgid "Style Source"
    863919msgstr ""
    864920
    865 #: source/work/inc/kcp-cspgen-common.php:288
     921#: source/work/inc/kcp-cspgen-common.php:339
    866922msgid "Specifies valid sources for stylesheets."
    867923msgstr ""
    868924
    869 #: source/work/inc/kcp-cspgen-common.php:292
     925#: source/work/inc/kcp-cspgen-common.php:343
    870926msgid "Style Source Elements"
    871927msgstr ""
    872928
    873 #: source/work/inc/kcp-cspgen-common.php:293
     929#: source/work/inc/kcp-cspgen-common.php:344
    874930msgid "Specifies valid sources for stylesheets &lt;style&gt; elements and &lt;link&gt; elements with rel=\"stylesheet\"."
    875931msgstr ""
    876932
    877 #: source/work/inc/kcp-cspgen-common.php:297
     933#: source/work/inc/kcp-cspgen-common.php:348
    878934msgid "Style Source Attributes"
    879935msgstr ""
    880936
    881 #: source/work/inc/kcp-cspgen-common.php:298
     937#: source/work/inc/kcp-cspgen-common.php:349
    882938msgid "Specifies valid sources for inline styles applied to individual DOM elements."
    883939msgstr ""
    884940
    885 #: source/work/inc/kcp-cspgen-common.php:302
     941#: source/work/inc/kcp-cspgen-common.php:353
    886942msgid "Worker Source"
    887943msgstr ""
    888944
    889 #: source/work/inc/kcp-cspgen-common.php:303
     945#: source/work/inc/kcp-cspgen-common.php:354
    890946msgid "Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts."
    891947msgstr ""
    … …  
    908964
    909965#: source/work/inc/kcp-cspgen-settings.php:135, source/work/inc/kcp-cspgen-settings.php:154
    910 msgid "<p><strong>NOTE</strong><br />Make sure to check your web browsers <strong>Development Tools</strong> once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.</p>"
     966msgid "<p>NOTE<br />Make sure to check your web browsers Development Tools once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.</p>"
    911967msgstr ""
    912968
    … …  
    916972
    917973#: source/work/inc/kcp-cspgen-settings.php:144
    918 msgid "<p><strong>NOTE</strong><br />Make sure to check your web browsers <strong>Development Tools</strong> once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.<br /><br /><strong>Suggested:</strong><br />Add your domains to the necessary attribute prior to adding the external resource...</p>"
     974msgid "<p>NOTE<br />Make sure to check your web browsers Development Tools once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.<br /><br />Suggested:<br />Add your domains to the necessary attribute prior to adding the external resource...</p>"
    919975msgstr ""
    920976
    … …  
    9441000
    9451001#: source/work/inc/kcp-cspgen-settings.php:219
    946 msgid "This will attempt to apply all headers to the REST API of your site.<br /><strong>NOTE:</strong> Due to the default nature of the REST API, the headers will also be applied to the admin areas of the website. You will need to check for breakages after applying."
     1002msgid "This will attempt to apply all headers to the REST API of your site.<br />NOTE: Due to the default nature of the REST API, the headers will also be applied to the admin areas of the website. You will need to check for breakages after applying."
    9471003msgstr ""
    9481004
    … …  
    9641020
    9651021#: source/work/inc/kcp-cspgen-settings.php:247
    966 msgid "<strong>Include Subdomains?</strong>"
     1022msgid "Include Subdomains?"
    9671023msgstr ""
    9681024
    … …  
    9721028
    9731029#: source/work/inc/kcp-cspgen-settings.php:257
    974 msgid "<strong>Preload?</strong>"
     1030msgid "Preload?"
    9751031msgstr ""
    9761032
    … …  
    10161072
    10171073#: source/work/inc/kcp-cspgen-settings.php:310
    1018 msgid "Select the methods you wish to allow.<br /><strong>NOTE:</strong> Most public websites require at least GET to be viewable online.<br /><strong>NOTE 2:</strong> This will block unselected methods."
     1074msgid "Select the methods you wish to allow.<br />NOTE: Most public websites require at least GET to be viewable online.<br />NOTE 2: This will block unselected methods."
    10191075msgstr ""
    10201076
    … …  
    10801136
    10811137#: source/work/inc/kcp-cspgen-settings.php:351
    1082 msgid "Set the allowed access origin here.  Can either be an asterisk: <code>*</code>, or a FQDN URL: <code>https://example.com</code><br /><strong>NOTE: </strong>If nothing is put in here, we will default to <code>*</code>"
     1138msgid "Set the allowed access origin here.  Can either be an asterisk: <code>*</code>, or a FQDN URL: <code>https://example.com</code><br />NOTE: If nothing is put in here, we will default to <code>*</code>"
    10831139msgstr ""
    10841140
    … …  
    12241280
    12251281#: source/work/inc/kcp-cspgen-settings.php:552
    1226 msgid "<strong>Basic Auth Username</strong>"
     1282msgid "Basic Auth Username"
    12271283msgstr ""
    12281284
    … …  
    12321288
    12331289#: source/work/inc/kcp-cspgen-settings.php:564
    1234 msgid "<strong>Basic Auth Password</strong>"
     1290msgid "Basic Auth Password"
    12351291msgstr ""
    12361292
    … …  
    13121368
    13131369#: source/work/inc/kcp-cspgen-settings.php:701
    1314 msgid "Setting this will add another header to configure browser and frame permissions. See here for more information: <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy\" target=\"_blank\">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy</a><br /><br /><strong>NOTE: </strong> Some of these features are not implemented for all browsers, and/or could be experimental.  Please read through that information and decide what features you need, and what audiences you need to apply to."
     1370msgid "Setting this will add another header to configure browser and frame permissions. See here for more information: <a href=\"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy\" target=\"_blank\">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy</a><br /><br />NOTE: Some of these features are not implemented for all browsers, and/or could be experimental.  Please read through that information and decide what features you need, and what audiences you need to apply to."
    13151371msgstr ""
    13161372

  • security-header-generator/trunk/readme.txt

    r3420274 r3420349  
    66Tested up to: 7.0
    77Requires PHP: 8.2
    8 Stable tag: 5.3.67
     8Stable tag: 5.3.77
    99License: GPLv3
    1010License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    6969== Changelog ==
    7070
     71= 5.3.77 =
     72* Update: Fixes for "plugin checker"
     73* Remove: Permissions-Policy: ambient-light-sensor
     74    * Not compatible with any browsers: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/ambient-light-sensor
     75* Remove: Permissions-Policy: magnetometer
     76    * Not compatible with any browsers: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy/magnetometer
     77* Remove: Permissions-Policy: sync-xhr
     78    * Completely removed from spec
     79* Add: The following list of Permissions-Policy attributes:
     80    * bluetooth
     81    * captured-surface-control
     82    * compute-pressure
     83    * cross-origin-isolated
     84    * deferred-fetch
     85    * deferred-fetch-minimal
     86    * otp-credentials
     87    * storage-access
     88    * window-management
     89
    7190= 5.3.67 =
    7291* Verify: Core 7.0
    … …  
    7493* Update: Defaults for WordPress
    7594    * JS controller was causing issues with fields no populating properly
    76 * Update: Documentation
    7795* Remove: Enforce Certificate Transparency
    7896    * Deprecated: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Expect-CT

  • security-header-generator/trunk/security-header-generator.php

    r3420274 r3420349  
    1212Requires at least: 6.0.9
    1313Requires PHP: 8.2
    14 Version: 5.3.67
    15 Network: false
     14Version: 5.3.77
    1615Text Domain: security-header-generator
    1716License: GPLv3
    1817License URI: https://www.gnu.org/licenses/gpl-3.0.html
    19 Update URI: https://wordpress.org/plugins/security-header-generator/
    2018*/
    2119

  • security-header-generator/trunk/work/common.php

    r3303531 r3420349  
    2121
    2222        // it is, so throw and error message and exit
    23         wp_die( __( '<h1>PHP To Low</h1><p>Due to the nature of this plugin, it cannot be run on lower versions of PHP.</p><p>Please contact your hosting provider to upgrade your site to at least version 8.1.</p>', 'security-header-generator' ),
    24             __( 'Cannot Activate: PHP To Low', 'security-header-generator' ),
     23        wp_die( esc_html_e( '<h1>PHP To Low</h1><p>Due to the nature of this plugin, it cannot be run on lower versions of PHP.</p><p>Please contact your hosting provider to upgrade your site to at least version 8.1.</p>', 'security-header-generator' ),
     24            esc_html_e( 'Cannot Activate: PHP To Low', 'security-header-generator' ),
    2525            array(
    2626                'back_link' => true,
    … …  
    3434        // we did, so... throw an error message and exit
    3535        wp_die(
    36             __( '<h1>Cannot Network Activate</h1><p>Due to the nature of this plugin, it cannot be network activated.</p><p>Please go back, and activate inside your subsites.</p>', 'security-header-generator' ),
    37             __( 'Cannot Network Activate', 'security-header-generator' ),
     36            esc_html_e( '<h1>Cannot Network Activate</h1><p>Due to the nature of this plugin, it cannot be network activated.</p><p>Please go back, and activate inside your subsites.</p>', 'security-header-generator' ),
     37            esc_html_e( 'Cannot Network Activate', 'security-header-generator' ),
    3838            array(
    3939                'back_link' => true,
    … …  
    132132    add_action( 'admin_notices', function( ) : void {
    133133
    134         // if the site is under PHP 8.1
    135         if ( version_compare( PHP_VERSION, '8.1', '<=' ) ) {
     134        // if the site is under PHP 8.2
     135        if ( version_compare( PHP_VERSION, '8.2', '<=' ) ) {
    136136
    137137            // show this notice
    138138            ?>
    139139            <div class="notice notice-info is-dismissible">
    140                 <p><?php _e( "<h3>PHP Upgrade Notice</h3><p>To maintain the security standards of the <strong>Security Header Generator</strong> plugin this will be the final version that supports PHP versions lower than 8.1. Your site must be upgraded in order to update the plugin to future versions.</p><p>Please see here for up to date PHP version information: <a href='https://www.php.net/supported-versions.php' target='_blank'>https://www.php.net/supported-versions.php</a></p>", 'security-header-generator' ); ?></p>
     140                <h3><?php esc_html_e( "PHP Upgrade Notice", 'security-header-generator' ); ?></h3>
     141                <p><?php esc_html_e( "To maintain the security standards of the Security Header Generator plugin this will be the final version that supports PHP versions lower than 8.2. Your site must be upgraded in order to update the plugin to future versions.", 'security-header-generator' ); ?>
     142                <p><?php esc_html_e( "Please see here for up to date PHP version information: https://www.php.net/supported-versions.php", 'security-header-generator' ); ?></p>
    141143            </div>
    142144        <?php

  • security-header-generator/trunk/work/doc.php

    r3420274 r3420349  
    2323    }
    2424</style>
    25     <p><?php _e( 'This plugin generates the proper security HTTP response headers and generates a Content Security Policy if configured to do so', 'security-header-generator' ); ?>.</p>
    26    
    27     <h3 id="install"><?php _e( 'Install', 'security-header-generator' ); ?></h3>
     25    <p><?php esc_html_e( 'This plugin generates the proper security HTTP response headers and generates a Content Security Policy if configured to do so', 'security-header-generator' ); ?>.</p>
     26   
     27    <h3 id="install"><?php esc_html_e( 'Install', 'security-header-generator' ); ?></h3>
    2828    <ul class="the_list">
    29         <li><?php _e( 'Download the plugin, unzip it, and upload to your sites', 'security-header-generator' ); ?> <code>/wp-content/plugins/</code> <?php _e( 'directory', 'security-header-generator' ); ?>
     29        <li><?php esc_html_e( 'Download the plugin, unzip it, and upload to your sites', 'security-header-generator' ); ?> <code>/wp-content/plugins/</code> <?php esc_html_e( 'directory', 'security-header-generator' ); ?>
    3030            <ul class="the_list">
    31                 <li><?php _e( 'You can also upload it directly to your Plugins admin', 'security-header-generator' ); ?></li>
     31                <li><?php esc_html_e( 'You can also upload it directly to your Plugins admin', 'security-header-generator' ); ?></li>
    3232            </ul>
    3333        </li>
    34         <li><?php _e( 'Activate the plugin through the "Plugins" menu in WordPress', 'security-header-generator' ); ?></li>
     34        <li><?php esc_html_e( 'Activate the plugin through the "Plugins" menu in WordPress', 'security-header-generator' ); ?></li>
    3535    </ul>
    3636   
    37     <h3 id="usage"><?php _e( 'Usage', 'security-header-generator' ); ?></h3>
    38     <p><?php _e( 'Head over to the admin section of your site and click "Security Headers", configure how you need it to be configured. The configured headers will automatically be implemented.', 'security-header-generator' ); ?></p>
    39    
    40     <h3 id="gotcha"><?php _e( 'IMPORTANT: Hosting Environment Considerations', 'security-header-generator' ); ?></h3>
    41     <p><?php _e( 'If your hosting environment is already setting these headers, most likely your settings in this plugin will <strong>NOT</strong> override the values you specify', 'security-header-generator' ); ?>.</p>
    42     <p><?php _e( 'If this is the case, please check with your hosting company or review your server configuration for headers being set. The plugin will do its best to override them, but in some environments this is just not possible', 'security-header-generator' ); ?>.</p>
    43    
    44     <h3 id="settings"><?php _e( 'Settings Overview', 'security-header-generator' ); ?></h3>
     37    <h3 id="usage"><?php esc_html_e( 'Usage', 'security-header-generator' ); ?></h3>
     38    <p><?php esc_html_e( 'Head over to the admin section of your site and click "Security Headers", configure how you need it to be configured. The configured headers will automatically be implemented.', 'security-header-generator' ); ?></p>
     39   
     40    <h3 id="gotcha"><?php esc_html_e( 'IMPORTANT: Hosting Environment Considerations', 'security-header-generator' ); ?></h3>
     41    <p><?php esc_html_e( 'If your hosting environment is already setting these headers, most likely your settings in this plugin will <strong>NOT</strong> override the values you specify', 'security-header-generator' ); ?>.</p>
     42    <p><?php esc_html_e( 'If this is the case, please check with your hosting company or review your server configuration for headers being set. The plugin will do its best to override them, but in some environments this is just not possible', 'security-header-generator' ); ?>.</p>
     43   
     44    <h3 id="settings"><?php esc_html_e( 'Settings Overview', 'security-header-generator' ); ?></h3>
    4545   
    4646    <ul class="the_list">
    47         <li><h3><?php _e( 'Standard Security Headers Tab', 'security-header-generator' ); ?></h3>
    48             <p><?php _e( 'This tab controls the basic security headers that protect your website from common attacks and vulnerabilities.', 'security-header-generator' ); ?></p>
     47        <li><h3><?php esc_html_e( 'Standard Security Headers Tab', 'security-header-generator' ); ?></h3>
     48            <p><?php esc_html_e( 'This tab controls the basic security headers that protect your website from common attacks and vulnerabilities.', 'security-header-generator' ); ?></p>
    4949            <ul class="the_list">
    5050                <li>
    51                     <strong><?php _e( 'Apply to Admin', 'security-header-generator' ); ?></strong>
    52                     <ul class="the_list">
    53                         <li><?php _e( 'Choose whether to apply these security headers to the WordPress admin area in addition to your public-facing website. Enabling this provides protection for your admin panel as well.', 'security-header-generator' ); ?></li>
    54                     </ul>
    55                 </li>
    56                 <li>
    57                     <strong><?php _e( 'Apply to the REST API', 'security-header-generator' ); ?></strong>
    58                     <ul class="the_list">
    59                         <li><?php _e( 'Choose whether to apply these headers to your WordPress REST API. <strong>NOTE:</strong> Because of how WordPress works, enabling this will also apply headers to the admin areas. Test thoroughly after enabling to ensure nothing breaks.', 'security-header-generator' ); ?></li>
    60                     </ul>
    61                 </li>
    62                 <li>
    63                     <strong><?php _e( 'Strict Transport Security', 'security-header-generator' ); ?></strong>
    64                     <ul class="the_list">
    65                         <li>
    66                             <?php _e( 'This forces browsers to only access your site over HTTPS (secure connections), preventing downgrade attacks where someone might try to force an insecure HTTP connection.', 'security-header-generator' ); ?>
    67                             <ul class="the_list">
    68                                 <li>
    69                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     51                    <strong><?php esc_html_e( 'Apply to Admin', 'security-header-generator' ); ?></strong>
     52                    <ul class="the_list">
     53                        <li><?php esc_html_e( 'Choose whether to apply these security headers to the WordPress admin area in addition to your public-facing website. Enabling this provides protection for your admin panel as well.', 'security-header-generator' ); ?></li>
     54                    </ul>
     55                </li>
     56                <li>
     57                    <strong><?php esc_html_e( 'Apply to the REST API', 'security-header-generator' ); ?></strong>
     58                    <ul class="the_list">
     59                        <li><?php esc_html_e( 'Choose whether to apply these headers to your WordPress REST API. <strong>NOTE:</strong> Because of how WordPress works, enabling this will also apply headers to the admin areas. Test thoroughly after enabling to ensure nothing breaks.', 'security-header-generator' ); ?></li>
     60                    </ul>
     61                </li>
     62                <li>
     63                    <strong><?php esc_html_e( 'Strict Transport Security', 'security-header-generator' ); ?></strong>
     64                    <ul class="the_list">
     65                        <li>
     66                            <?php esc_html_e( 'This forces browsers to only access your site over HTTPS (secure connections), preventing downgrade attacks where someone might try to force an insecure HTTP connection.', 'security-header-generator' ); ?>
     67                            <ul class="the_list">
     68                                <li>
     69                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    7070                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security</a>
    7171                                </li>
    … …  
    7373                        </li>
    7474                        <li>
    75                             <?php _e( 'Configuration options:', 'security-header-generator' ); ?>
    76                             <ul class="the_list">
    77                                 <li><strong><?php _e( 'Cache Age:', 'security-header-generator' ); ?></strong> <?php _e( 'How long (in seconds) browsers should remember to only use HTTPS. Default is 31536000 (1 year).', 'security-header-generator' ); ?></li>
    78                                 <li><strong><?php _e( 'Include Subdomains:', 'security-header-generator' ); ?></strong> <?php _e( 'Apply this rule to all subdomains (like blog.yoursite.com, shop.yoursite.com). Only enable if ALL your subdomains use HTTPS.', 'security-header-generator' ); ?></li>
    79                                 <li><strong><?php _e( 'Preload:', 'security-header-generator' ); ?></strong> <?php _e( 'Submit your site to browsers\' preload lists for maximum security. If enabled, change Cache Age to 63072000 (2 years). Learn more:', 'security-header-generator' ); ?> <a href="https://hstspreload.org/" target="_blank">https://hstspreload.org/</a></li>
    80                             </ul>
    81                         </li>
    82                     </ul>
    83                 </li>
    84                 <li>
    85                     <strong><?php _e( 'Frame Sources', 'security-header-generator' ); ?></strong>
    86                     <ul class="the_list">
    87                         <li>
    88                             <?php _e( 'Controls whether other websites can display your site in an iframe or frame. This prevents "clickjacking" attacks where attackers trick users by embedding your site invisibly.', 'security-header-generator' ); ?>
    89                             <ul class="the_list">
    90                                 <li>
    91                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     75                            <?php esc_html_e( 'Configuration options:', 'security-header-generator' ); ?>
     76                            <ul class="the_list">
     77                                <li><strong><?php esc_html_e( 'Cache Age:', 'security-header-generator' ); ?></strong> <?php esc_html_e( 'How long (in seconds) browsers should remember to only use HTTPS. Default is 31536000 (1 year).', 'security-header-generator' ); ?></li>
     78                                <li><strong><?php esc_html_e( 'Include Subdomains:', 'security-header-generator' ); ?></strong> <?php esc_html_e( 'Apply this rule to all subdomains (like blog.yoursite.com, shop.yoursite.com). Only enable if ALL your subdomains use HTTPS.', 'security-header-generator' ); ?></li>
     79                                <li><strong><?php esc_html_e( 'Preload:', 'security-header-generator' ); ?></strong> <?php esc_html_e( 'Submit your site to browsers\' preload lists for maximum security. If enabled, change Cache Age to 63072000 (2 years). Learn more:', 'security-header-generator' ); ?> <a href="https://hstspreload.org/" target="_blank">https://hstspreload.org/</a></li>
     80                            </ul>
     81                        </li>
     82                    </ul>
     83                </li>
     84                <li>
     85                    <strong><?php esc_html_e( 'Frame Sources', 'security-header-generator' ); ?></strong>
     86                    <ul class="the_list">
     87                        <li>
     88                            <?php esc_html_e( 'Controls whether other websites can display your site in an iframe or frame. This prevents "clickjacking" attacks where attackers trick users by embedding your site invisibly.', 'security-header-generator' ); ?>
     89                            <ul class="the_list">
     90                                <li>
     91                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    9292                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options</a>
    9393                                </li>
    … …  
    9595                        </li>
    9696                        <li>
    97                             <?php _e( 'Options:', 'security-header-generator' ); ?>
    98                             <ul class="the_list">
    99                                 <li><strong>DENY:</strong> <?php _e( 'Block all websites from framing your site (most secure)', 'security-header-generator' ); ?></li>
    100                                 <li><strong>SAMEORIGIN:</strong> <?php _e( 'Only allow your own domain to frame your site (useful if you need iframes on your own site)', 'security-header-generator' ); ?></li>
    101                             </ul>
    102                         </li>
    103                     </ul>
    104                 </li>
    105                 <li>
    106                     <strong><?php _e( 'Access Control Methods', 'security-header-generator' ); ?></strong>
    107                     <ul class="the_list">
    108                         <li>
    109                             <?php _e( 'Controls which HTTP request methods (like GET, POST, etc.) external websites can use when accessing your site. This is useful for API security.', 'security-header-generator' ); ?>
    110                             <ul class="the_list">
    111                                 <li>
    112                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     97                            <?php esc_html_e( 'Options:', 'security-header-generator' ); ?>
     98                            <ul class="the_list">
     99                                <li><strong>DENY:</strong> <?php esc_html_e( 'Block all websites from framing your site (most secure)', 'security-header-generator' ); ?></li>
     100                                <li><strong>SAMEORIGIN:</strong> <?php esc_html_e( 'Only allow your own domain to frame your site (useful if you need iframes on your own site)', 'security-header-generator' ); ?></li>
     101                            </ul>
     102                        </li>
     103                    </ul>
     104                </li>
     105                <li>
     106                    <strong><?php esc_html_e( 'Access Control Methods', 'security-header-generator' ); ?></strong>
     107                    <ul class="the_list">
     108                        <li>
     109                            <?php esc_html_e( 'Controls which HTTP request methods (like GET, POST, etc.) external websites can use when accessing your site. This is useful for API security.', 'security-header-generator' ); ?>
     110                            <ul class="the_list">
     111                                <li>
     112                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    113113                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods</a>
    114114                                </li>
    … …  
    116116                        </li>
    117117                        <li>
    118                             <?php _e( 'Select which methods to allow. Most public websites need at least GET (for viewing pages). Clicking "Allow All" will check or uncheck all options. <strong>Note:</strong> Unselected methods will be blocked.', 'security-header-generator' ); ?>
    119                         </li>
    120                     </ul>
    121                 </li>
    122                 <li>
    123                     <strong><?php _e( 'Access Control Credentials', 'security-header-generator' ); ?></strong>
    124                     <ul class="the_list">
    125                         <li>
    126                             <?php _e( 'Allows browsers to send cookies and authentication information when JavaScript makes requests to your site. Useful for AJAX-based features and API calls that require user authentication.', 'security-header-generator' ); ?>
    127                             <ul class="the_list">
    128                                 <li>
    129                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     118                            <?php esc_html_e( 'Select which methods to allow. Most public websites need at least GET (for viewing pages). Clicking "Allow All" will check or uncheck all options. <strong>Note:</strong> Unselected methods will be blocked.', 'security-header-generator' ); ?>
     119                        </li>
     120                    </ul>
     121                </li>
     122                <li>
     123                    <strong><?php esc_html_e( 'Access Control Credentials', 'security-header-generator' ); ?></strong>
     124                    <ul class="the_list">
     125                        <li>
     126                            <?php esc_html_e( 'Allows browsers to send cookies and authentication information when JavaScript makes requests to your site. Useful for AJAX-based features and API calls that require user authentication.', 'security-header-generator' ); ?>
     127                            <ul class="the_list">
     128                                <li>
     129                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    130130                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials</a>
    131131                                </li>
    … …  
    133133                        </li>
    134134                        <li>
    135                             <?php _e( 'Default is Yes. Most modern websites need this enabled for JavaScript-driven features to work properly.', 'security-header-generator' ); ?>
    136                         </li>
    137                     </ul>
    138                 </li>
    139                 <li>
    140                     <strong><?php _e( 'Access Control Origin', 'security-header-generator' ); ?></strong>
    141                     <ul class="the_list">
    142                         <li>
    143                             <?php _e( 'Specifies which external websites can access your site\'s resources. This helps prevent unauthorized cross-site requests.', 'security-header-generator' ); ?>
    144                             <ul class="the_list">
    145                                 <li>
    146                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     135                            <?php esc_html_e( 'Default is Yes. Most modern websites need this enabled for JavaScript-driven features to work properly.', 'security-header-generator' ); ?>
     136                        </li>
     137                    </ul>
     138                </li>
     139                <li>
     140                    <strong><?php esc_html_e( 'Access Control Origin', 'security-header-generator' ); ?></strong>
     141                    <ul class="the_list">
     142                        <li>
     143                            <?php esc_html_e( 'Specifies which external websites can access your site\'s resources. This helps prevent unauthorized cross-site requests.', 'security-header-generator' ); ?>
     144                            <ul class="the_list">
     145                                <li>
     146                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    147147                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin</a>
    148148                                </li>
    … …  
    150150                        </li>
    151151                        <li>
    152                             <?php _e( 'Enter a specific domain (like <code>https://example.com</code>) or use <code>*</code> to allow all domains. If left empty, defaults to <code>*</code>.', 'security-header-generator' ); ?>
    153                         </li>
    154                     </ul>
    155                 </li>
    156                 <li>
    157                     <strong><?php _e( 'Prevent MimeType Sniffing', 'security-header-generator' ); ?></strong>
    158                     <ul class="the_list">
    159                         <li>
    160                             <?php _e( 'Stops browsers from trying to "guess" the type of files you serve. This prevents attackers from disguising malicious files as safe ones.', 'security-header-generator' ); ?>
    161                             <ul class="the_list">
    162                                 <li>
    163                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     152                            <?php esc_html_e( 'Enter a specific domain (like <code>https://example.com</code>) or use <code>*</code> to allow all domains. If left empty, defaults to <code>*</code>.', 'security-header-generator' ); ?>
     153                        </li>
     154                    </ul>
     155                </li>
     156                <li>
     157                    <strong><?php esc_html_e( 'Prevent MimeType Sniffing', 'security-header-generator' ); ?></strong>
     158                    <ul class="the_list">
     159                        <li>
     160                            <?php esc_html_e( 'Stops browsers from trying to "guess" the type of files you serve. This prevents attackers from disguising malicious files as safe ones.', 'security-header-generator' ); ?>
     161                            <ul class="the_list">
     162                                <li>
     163                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    164164                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options</a>
    165165                                </li>
    … …  
    169169                </li>
    170170                <li>
    171                     <strong><?php _e( 'Origin Referrers', 'security-header-generator' ); ?></strong>
    172                     <ul class="the_list">
    173                         <li>
    174                             <?php _e( 'Controls how much information about your site is shared when users click links to external websites. This protects user privacy.', 'security-header-generator' ); ?>
    175                             <ul class="the_list">
    176                                 <li>
    177                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     171                    <strong><?php esc_html_e( 'Origin Referrers', 'security-header-generator' ); ?></strong>
     172                    <ul class="the_list">
     173                        <li>
     174                            <?php esc_html_e( 'Controls how much information about your site is shared when users click links to external websites. This protects user privacy.', 'security-header-generator' ); ?>
     175                            <ul class="the_list">
     176                                <li>
     177                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    178178                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy</a>
    179179                                </li>
    … …  
    181181                        </li>
    182182                        <li>
    183                             <?php _e( 'Policy options (from most private to least private):', 'security-header-generator' ); ?>
    184                             <ul class="the_list">
    185                                 <li><strong>no-referrer:</strong> <?php _e( 'Share no information at all', 'security-header-generator' ); ?></li>
    186                                 <li><strong>strict-origin:</strong> <?php _e( 'Only share your domain name, only on secure (HTTPS) connections (recommended)', 'security-header-generator' ); ?></li>
    187                                 <li><strong>origin:</strong> <?php _e( 'Only share your domain name', 'security-header-generator' ); ?></li>
    188                                 <li><strong>same-origin:</strong> <?php _e( 'Share full URL within your own site, but only domain for external sites', 'security-header-generator' ); ?></li>
    189                                 <li><strong>strict-origin-when-cross-origin:</strong> <?php _e( 'Share full URL on your site, domain only for external sites (on secure connections)', 'security-header-generator' ); ?></li>
    190                                 <li><strong>origin-when-cross-origin:</strong> <?php _e( 'Share full URL on your site, domain only for external sites', 'security-header-generator' ); ?></li>
    191                                 <li><strong>no-referrer-when-downgrade:</strong> <?php _e( 'Share full URL except when moving from HTTPS to HTTP', 'security-header-generator' ); ?></li>
    192                                 <li><strong>unsafe-url:</strong> <?php _e( 'Always share full URL (least private)', 'security-header-generator' ); ?></li>
    193                             </ul>
    194                         </li>
    195                     </ul>
    196                 </li>
    197                 <li>
    198                     <strong><?php _e( 'Force Downloads', 'security-header-generator' ); ?></strong>
    199                     <ul class="the_list">
    200                         <li>
    201                             <?php _e( 'Forces certain files to be downloaded rather than opened directly in the browser. This adds an extra layer of security for file handling.', 'security-header-generator' ); ?>
    202                             <ul class="the_list">
    203                                 <li><?php _e( 'Learn more:', 'security-header-generator' ); ?> <a target="_blank" href="https://www.nwebsec.com/HttpHeaders/SecurityHeaders/XDownloadOptions">https://www.nwebsec.com/HttpHeaders/SecurityHeaders/XDownloadOptions</a></li>
    204                             </ul>
    205                         </li>
    206                     </ul>
    207                 </li>
    208                 <li>
    209                     <strong><?php _e( 'Cross Domain Origins', 'security-header-generator' ); ?></strong>
    210                     <ul class="the_list">
    211                         <li>
    212                             <?php _e( 'Blocks cross-domain access for PDFs and Flash content embedded on your site. This prevents certain types of attacks using these file types.', 'security-header-generator' ); ?>
    213                             <ul class="the_list">
    214                                 <li>
    215                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     183                            <?php esc_html_e( 'Policy options (from most private to least private):', 'security-header-generator' ); ?>
     184                            <ul class="the_list">
     185                                <li><strong>no-referrer:</strong> <?php esc_html_e( 'Share no information at all', 'security-header-generator' ); ?></li>
     186                                <li><strong>strict-origin:</strong> <?php esc_html_e( 'Only share your domain name, only on secure (HTTPS) connections (recommended)', 'security-header-generator' ); ?></li>
     187                                <li><strong>origin:</strong> <?php esc_html_e( 'Only share your domain name', 'security-header-generator' ); ?></li>
     188                                <li><strong>same-origin:</strong> <?php esc_html_e( 'Share full URL within your own site, but only domain for external sites', 'security-header-generator' ); ?></li>
     189                                <li><strong>strict-origin-when-cross-origin:</strong> <?php esc_html_e( 'Share full URL on your site, domain only for external sites (on secure connections)', 'security-header-generator' ); ?></li>
     190                                <li><strong>origin-when-cross-origin:</strong> <?php esc_html_e( 'Share full URL on your site, domain only for external sites', 'security-header-generator' ); ?></li>
     191                                <li><strong>no-referrer-when-downgrade:</strong> <?php esc_html_e( 'Share full URL except when moving from HTTPS to HTTP', 'security-header-generator' ); ?></li>
     192                                <li><strong>unsafe-url:</strong> <?php esc_html_e( 'Always share full URL (least private)', 'security-header-generator' ); ?></li>
     193                            </ul>
     194                        </li>
     195                    </ul>
     196                </li>
     197                <li>
     198                    <strong><?php esc_html_e( 'Force Downloads', 'security-header-generator' ); ?></strong>
     199                    <ul class="the_list">
     200                        <li>
     201                            <?php esc_html_e( 'Forces certain files to be downloaded rather than opened directly in the browser. This adds an extra layer of security for file handling.', 'security-header-generator' ); ?>
     202                            <ul class="the_list">
     203                                <li><?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?> <a target="_blank" href="https://www.nwebsec.com/HttpHeaders/SecurityHeaders/XDownloadOptions">https://www.nwebsec.com/HttpHeaders/SecurityHeaders/XDownloadOptions</a></li>
     204                            </ul>
     205                        </li>
     206                    </ul>
     207                </li>
     208                <li>
     209                    <strong><?php esc_html_e( 'Cross Domain Origins', 'security-header-generator' ); ?></strong>
     210                    <ul class="the_list">
     211                        <li>
     212                            <?php esc_html_e( 'Blocks cross-domain access for PDFs and Flash content embedded on your site. This prevents certain types of attacks using these file types.', 'security-header-generator' ); ?>
     213                            <ul class="the_list">
     214                                <li>
     215                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    216216                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Permitted-Cross-Domain-Policies">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Permitted-Cross-Domain-Policies</a>
    217217                                </li>
    … …  
    221221                </li>
    222222                <li>
    223                     <strong><?php _e( 'Upgrade Insecure Requests', 'security-header-generator' ); ?></strong>
    224                     <ul class="the_list">
    225                         <li>
    226                             <?php _e( 'Automatically upgrades all insecure (HTTP) requests to secure (HTTPS) requests. This ensures all resources load securely even if old links reference HTTP.', 'security-header-generator' ); ?>
    227                             <ul class="the_list">
    228                                 <li>
    229                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     223                    <strong><?php esc_html_e( 'Upgrade Insecure Requests', 'security-header-generator' ); ?></strong>
     224                    <ul class="the_list">
     225                        <li>
     226                            <?php esc_html_e( 'Automatically upgrades all insecure (HTTP) requests to secure (HTTPS) requests. This ensures all resources load securely even if old links reference HTTP.', 'security-header-generator' ); ?>
     227                            <ul class="the_list">
     228                                <li>
     229                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    230230                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests</a>
    231231                                </li>
    … …  
    235235                </li>
    236236                <li>
    237                     <strong><?php _e( 'Cross Origin Embedder Policy', 'security-header-generator' ); ?></strong>
    238                     <ul class="the_list">
    239                         <li>
    240                             <?php _e( 'Controls how your site can embed resources from other domains. This prevents certain types of attacks involving embedded content.', 'security-header-generator' ); ?>
    241                             <ul class="the_list">
    242                                 <li>
    243                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     237                    <strong><?php esc_html_e( 'Cross Origin Embedder Policy', 'security-header-generator' ); ?></strong>
     238                    <ul class="the_list">
     239                        <li>
     240                            <?php esc_html_e( 'Controls how your site can embed resources from other domains. This prevents certain types of attacks involving embedded content.', 'security-header-generator' ); ?>
     241                            <ul class="the_list">
     242                                <li>
     243                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    244244                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy</a>
    245245                                </li>
    … …  
    247247                        </li>
    248248                        <li>
    249                             <?php _e( 'Options:', 'security-header-generator' ); ?>
    250                             <ul class="the_list">
    251                                 <li><strong>unsafe-none:</strong> <?php _e( 'Allow embedding external resources without explicit permission (default, less secure)', 'security-header-generator' ); ?></li>
    252                                 <li><strong>require-corp:</strong> <?php _e( 'Only allow resources explicitly marked as embeddable (more secure, may require configuration)', 'security-header-generator' ); ?></li>
    253                             </ul>
    254                         </li>
    255                     </ul>
    256                 </li>
    257                 <li>
    258                     <strong><?php _e( 'Cross Origin Resource Policy', 'security-header-generator' ); ?></strong>
    259                     <ul class="the_list">
    260                         <li>
    261                             <?php _e( 'Controls which websites can load resources (images, scripts, etc.) from your site. This prevents unauthorized use of your content.', 'security-header-generator' ); ?>
    262                             <ul class="the_list">
    263                                 <li>
    264                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     249                            <?php esc_html_e( 'Options:', 'security-header-generator' ); ?>
     250                            <ul class="the_list">
     251                                <li><strong>unsafe-none:</strong> <?php esc_html_e( 'Allow embedding external resources without explicit permission (default, less secure)', 'security-header-generator' ); ?></li>
     252                                <li><strong>require-corp:</strong> <?php esc_html_e( 'Only allow resources explicitly marked as embeddable (more secure, may require configuration)', 'security-header-generator' ); ?></li>
     253                            </ul>
     254                        </li>
     255                    </ul>
     256                </li>
     257                <li>
     258                    <strong><?php esc_html_e( 'Cross Origin Resource Policy', 'security-header-generator' ); ?></strong>
     259                    <ul class="the_list">
     260                        <li>
     261                            <?php esc_html_e( 'Controls which websites can load resources (images, scripts, etc.) from your site. This prevents unauthorized use of your content.', 'security-header-generator' ); ?>
     262                            <ul class="the_list">
     263                                <li>
     264                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    265265                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy">https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy</a>
    266266                                </li>
    … …  
    268268                        </li>
    269269                        <li>
    270                             <?php _e( 'Options:', 'security-header-generator' ); ?>
    271                             <ul class="the_list">
    272                                 <li><strong>same-origin:</strong> <?php _e( 'Only your exact domain can use your resources (most secure)', 'security-header-generator' ); ?></li>
    273                                 <li><strong>same-site:</strong> <?php _e( 'Your domain and subdomains can use your resources', 'security-header-generator' ); ?></li>
    274                                 <li><strong>cross-origin:</strong> <?php _e( 'Any website can use your resources (least secure)', 'security-header-generator' ); ?></li>
    275                             </ul>
    276                         </li>
    277                     </ul>
    278                 </li>
    279                 <li>
    280                     <strong><?php _e( 'Cross Origin Opener Policy', 'security-header-generator' ); ?></strong>
    281                     <ul class="the_list">
    282                         <li>
    283                             <?php _e( 'Controls whether other websites can access your site when opened in popups or new tabs. This prevents certain cross-site attacks.', 'security-header-generator' ); ?>
    284                             <ul class="the_list">
    285                                 <li>
    286                                     <?php _e( 'Learn more:', 'security-header-generator' ); ?>
     270                            <?php esc_html_e( 'Options:', 'security-header-generator' ); ?>
     271                            <ul class="the_list">
     272                                <li><strong>same-origin:</strong> <?php esc_html_e( 'Only your exact domain can use your resources (most secure)', 'security-header-generator' ); ?></li>
     273                                <li><strong>same-site:</strong> <?php esc_html_e( 'Your domain and subdomains can use your resources', 'security-header-generator' ); ?></li>
     274                                <li><strong>cross-origin:</strong> <?php esc_html_e( 'Any website can use your resources (least secure)', 'security-header-generator' ); ?></li>
     275                            </ul>
     276                        </li>
     277                    </ul>
     278                </li>
     279                <li>
     280                    <strong><?php esc_html_e( 'Cross Origin Opener Policy', 'security-header-generator' ); ?></strong>
     281                    <ul class="the_list">
     282                        <li>
     283                            <?php esc_html_e( 'Controls whether other websites can access your site when opened in popups or new tabs. This prevents certain cross-site attacks.', 'security-header-generator' ); ?>
     284                            <ul class="the_list">
     285                                <li>
     286                                    <?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?>
    287287                                    <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy</a>
    288288                                </li>
    … …  
    290290                        </li>
    291291                        <li>
    292                             <?php _e( 'Options:', 'security-header-generator' ); ?>
    293                             <ul class="the_list">
    294                                 <li><strong>unsafe-none:</strong> <?php _e( 'Allow normal popup/tab behavior (default)', 'security-header-generator' ); ?></li>
    295                                 <li><strong>same-origin-allow-popups:</strong> <?php _e( 'Allow popups but isolate from other origins', 'security-header-generator' ); ?></li>
    296                                 <li><strong>same-origin:</strong> <?php _e( 'Complete isolation from other origins (most secure)', 'security-header-generator' ); ?></li>
     292                            <?php esc_html_e( 'Options:', 'security-header-generator' ); ?>
     293                            <ul class="the_list">
     294                                <li><strong>unsafe-none:</strong> <?php esc_html_e( 'Allow normal popup/tab behavior (default)', 'security-header-generator' ); ?></li>
     295                                <li><strong>same-origin-allow-popups:</strong> <?php esc_html_e( 'Allow popups but isolate from other origins', 'security-header-generator' ); ?></li>
     296                                <li><strong>same-origin:</strong> <?php esc_html_e( 'Complete isolation from other origins (most secure)', 'security-header-generator' ); ?></li>
    297297                            </ul>
    298298                        </li>
    … …  
    302302        </li>
    303303       
    304         <li><h3><?php _e( 'Content Security Policy Tab', 'security-header-generator' ); ?></h3>
    305             <p><?php _e( 'Content Security Policy (CSP) is an advanced security feature that controls which external resources your website can load. This prevents many types of attacks including Cross-Site Scripting (XSS).', 'security-header-generator' ); ?></p>
     304        <li><h3><?php esc_html_e( 'Content Security Policy Tab', 'security-header-generator' ); ?></h3>
     305            <p><?php esc_html_e( 'Content Security Policy (CSP) is an advanced security feature that controls which external resources your website can load. This prevents many types of attacks including Cross-Site Scripting (XSS).', 'security-header-generator' ); ?></p>
    306306            <ul class="the_list">
    307307                <li>
    308                     <strong><?php _e( 'Generate CSP', 'security-header-generator' ); ?></strong>
    309                     <ul class="the_list">
    310                         <li>
    311                             <?php _e( 'Enable this to create a Content Security Policy for your site. This will show many additional fields where you can specify which external resources (scripts, styles, images, etc.) are allowed to load.', 'security-header-generator' ); ?>
    312                             <ul class="the_list">
    313                                 <li><?php _e( 'Enter external domains in the Source fields using a space-separated list (example: <code>cdn.example.com fonts.google.com</code>)', 'security-header-generator' ); ?></li>
    314                                 <li><?php _e( 'Learn more:', 'security-header-generator' ); ?> <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP</a></li>
    315                             </ul>
    316                         </li>
    317                     </ul>
    318                 </li>
    319                 <li>
    320                     <strong><?php _e( 'Apply to Admin', 'security-header-generator' ); ?></strong>
    321                     <ul class="the_list">
    322                         <li><?php _e( 'Choose whether to apply the Content Security Policy to your WordPress admin area as well as the public site. <strong>Warning:</strong> This may break admin features if not configured correctly. Test thoroughly.', 'security-header-generator' ); ?></li>
    323                     </ul>
    324                 </li>
    325                 <li>
    326                     <strong><?php _e( 'Include WordPress Defaults', 'security-header-generator' ); ?></strong>
    327                     <ul class="the_list">
    328                         <li>
    329                             <?php _e( 'This toggle controls whether WordPress default domains are <strong>added to</strong> your custom values. It does NOT replace your custom settings.', 'security-header-generator' ); ?>
    330                         </li>
    331                         <li>
    332                             <?php _e( 'How it works:', 'security-header-generator' ); ?>
    333                             <ul class="the_list">
    334                                 <li><strong><?php _e( 'When ON:', 'security-header-generator' ); ?></strong> <?php _e( 'Your custom domains PLUS WordPress default domains are included in the CSP', 'security-header-generator' ); ?></li>
    335                                 <li><strong><?php _e( 'When OFF:', 'security-header-generator' ); ?></strong> <?php _e( 'Only your custom domains are included in the CSP', 'security-header-generator' ); ?></li>
    336                             </ul>
    337                         </li>
    338                         <li>
    339                             <?php _e( 'WordPress default domains that will be added when enabled:', 'security-header-generator' ); ?>
     308                    <strong><?php esc_html_e( 'Generate CSP', 'security-header-generator' ); ?></strong>
     309                    <ul class="the_list">
     310                        <li>
     311                            <?php esc_html_e( 'Enable this to create a Content Security Policy for your site. This will show many additional fields where you can specify which external resources (scripts, styles, images, etc.) are allowed to load.', 'security-header-generator' ); ?>
     312                            <ul class="the_list">
     313                                <li><?php esc_html_e( 'Enter external domains in the Source fields using a space-separated list (example: <code>cdn.example.com fonts.google.com</code>)', 'security-header-generator' ); ?></li>
     314                                <li><?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?> <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP</a></li>
     315                            </ul>
     316                        </li>
     317                    </ul>
     318                </li>
     319                <li>
     320                    <strong><?php esc_html_e( 'Apply to Admin', 'security-header-generator' ); ?></strong>
     321                    <ul class="the_list">
     322                        <li><?php esc_html_e( 'Choose whether to apply the Content Security Policy to your WordPress admin area as well as the public site. <strong>Warning:</strong> This may break admin features if not configured correctly. Test thoroughly.', 'security-header-generator' ); ?></li>
     323                    </ul>
     324                </li>
     325                <li>
     326                    <strong><?php esc_html_e( 'Include WordPress Defaults', 'security-header-generator' ); ?></strong>
     327                    <ul class="the_list">
     328                        <li>
     329                            <?php esc_html_e( 'This toggle controls whether WordPress default domains are <strong>added to</strong> your custom values. It does NOT replace your custom settings.', 'security-header-generator' ); ?>
     330                        </li>
     331                        <li>
     332                            <?php esc_html_e( 'How it works:', 'security-header-generator' ); ?>
     333                            <ul class="the_list">
     334                                <li><strong><?php esc_html_e( 'When ON:', 'security-header-generator' ); ?></strong> <?php esc_html_e( 'Your custom domains PLUS WordPress default domains are included in the CSP', 'security-header-generator' ); ?></li>
     335                                <li><strong><?php esc_html_e( 'When OFF:', 'security-header-generator' ); ?></strong> <?php esc_html_e( 'Only your custom domains are included in the CSP', 'security-header-generator' ); ?></li>
     336                            </ul>
     337                        </li>
     338                        <li>
     339                            <?php esc_html_e( 'WordPress default domains that will be added when enabled:', 'security-header-generator' ); ?>
    340340                            <ul class="the_list">
    341341                                <li><strong>style-src:</strong> <code>https: *.googleapis.com</code></li>
    … …  
    351351                </li>
    352352                <li>
    353                     <strong><?php _e( 'Understanding CSP Directive Configuration', 'security-header-generator' ); ?></strong>
    354                     <ul class="the_list">
    355                         <li><?php _e( 'Each CSP directive (like script-src, style-src, etc.) has two configuration sections:', 'security-header-generator' ); ?></li>
    356                         <li>
    357                             <strong>1. <?php _e( 'Source Field (Left Side):', 'security-header-generator' ); ?></strong>
    358                             <ul class="the_list">
    359                                 <li><?php _e( 'Enter external domains that should be allowed for this type of resource', 'security-header-generator' ); ?></li>
    360                                 <li><?php _e( 'Example for scripts: <code>cdn.jsdelivr.net ajax.googleapis.com</code>', 'security-header-generator' ); ?></li>
    361                                 <li><?php _e( 'Separate multiple domains with spaces', 'security-header-generator' ); ?></li>
    362                             </ul>
    363                         </li>
    364                         <li>
    365                             <strong>2. <?php _e( 'Extra Settings Checkboxes (Right Side):', 'security-header-generator' ); ?></strong>
    366                             <ul class="the_list">
    367                                 <li><strong>Self:</strong> <?php _e( 'Allow resources from your own domain (recommended for most directives)', 'security-header-generator' ); ?></li>
    368                                 <li><strong>Inline:</strong> <?php _e( 'Allow inline styles/scripts embedded in your HTML. <strong>Warning:</strong> This reduces security and should only be used if necessary.', 'security-header-generator' ); ?></li>
    369                                 <li><strong>Eval:</strong> <?php _e( 'Allow JavaScript eval() function. <strong>Warning:</strong> This reduces security and should only be used if necessary.', 'security-header-generator' ); ?></li>
    370                                 <li><strong>None:</strong> <?php _e( 'Block ALL sources for this directive (overrides everything else). Use this to completely disable a resource type.', 'security-header-generator' ); ?></li>
    371                             </ul>
    372                         </li>
    373                     </ul>
    374                 </li>
    375                 <li>
    376                     <strong><?php _e( 'How WordPress Defaults Toggle Affects Settings', 'security-header-generator' ); ?></strong>
    377                     <ul class="the_list">
    378                         <li><?php _e( 'When you turn WordPress Defaults ON:', 'security-header-generator' ); ?>
    379                             <ul class="the_list">
    380                                 <li><?php _e( 'WordPress default domains are ADDED to your Source field values', 'security-header-generator' ); ?></li>
    381                                 <li><?php _e( 'Extra Settings checkboxes are temporarily set (usually "Self" is checked)', 'security-header-generator' ); ?></li>
    382                                 <li><?php _e( 'Your original checkbox selections are saved in the background', 'security-header-generator' ); ?></li>
    383                             </ul>
    384                         </li>
    385                         <li><?php _e( 'When you turn WordPress Defaults OFF:', 'security-header-generator' ); ?>
    386                             <ul class="the_list">
    387                                 <li><?php _e( 'WordPress default domains are removed', 'security-header-generator' ); ?></li>
    388                                 <li><?php _e( 'Your original Extra Settings checkbox selections are restored', 'security-header-generator' ); ?></li>
    389                             </ul>
    390                         </li>
    391                         <li>
    392                             <strong><?php _e( 'Important:', 'security-header-generator' ); ?></strong> <?php _e( 'Changes only take effect when you click "Save Settings". Toggling WordPress Defaults on/off without saving will not permanently change your configuration.', 'security-header-generator' ); ?>
     353                    <strong><?php esc_html_e( 'Understanding CSP Directive Configuration', 'security-header-generator' ); ?></strong>
     354                    <ul class="the_list">
     355                        <li><?php esc_html_e( 'Each CSP directive (like script-src, style-src, etc.) has two configuration sections:', 'security-header-generator' ); ?></li>
     356                        <li>
     357                            <strong>1. <?php esc_html_e( 'Source Field (Left Side):', 'security-header-generator' ); ?></strong>
     358                            <ul class="the_list">
     359                                <li><?php esc_html_e( 'Enter external domains that should be allowed for this type of resource', 'security-header-generator' ); ?></li>
     360                                <li><?php esc_html_e( 'Example for scripts: <code>cdn.jsdelivr.net ajax.googleapis.com</code>', 'security-header-generator' ); ?></li>
     361                                <li><?php esc_html_e( 'Separate multiple domains with spaces', 'security-header-generator' ); ?></li>
     362                            </ul>
     363                        </li>
     364                        <li>
     365                            <strong>2. <?php esc_html_e( 'Extra Settings Checkboxes (Right Side):', 'security-header-generator' ); ?></strong>
     366                            <ul class="the_list">
     367                                <li><strong>Self:</strong> <?php esc_html_e( 'Allow resources from your own domain (recommended for most directives)', 'security-header-generator' ); ?></li>
     368                                <li><strong>Inline:</strong> <?php esc_html_e( 'Allow inline styles/scripts embedded in your HTML. <strong>Warning:</strong> This reduces security and should only be used if necessary.', 'security-header-generator' ); ?></li>
     369                                <li><strong>Eval:</strong> <?php esc_html_e( 'Allow JavaScript eval() function. <strong>Warning:</strong> This reduces security and should only be used if necessary.', 'security-header-generator' ); ?></li>
     370                                <li><strong>None:</strong> <?php esc_html_e( 'Block ALL sources for this directive (overrides everything else). Use this to completely disable a resource type.', 'security-header-generator' ); ?></li>
     371                            </ul>
     372                        </li>
     373                    </ul>
     374                </li>
     375                <li>
     376                    <strong><?php esc_html_e( 'How WordPress Defaults Toggle Affects Settings', 'security-header-generator' ); ?></strong>
     377                    <ul class="the_list">
     378                        <li><?php esc_html_e( 'When you turn WordPress Defaults ON:', 'security-header-generator' ); ?>
     379                            <ul class="the_list">
     380                                <li><?php esc_html_e( 'WordPress default domains are ADDED to your Source field values', 'security-header-generator' ); ?></li>
     381                                <li><?php esc_html_e( 'Extra Settings checkboxes are temporarily set (usually "Self" is checked)', 'security-header-generator' ); ?></li>
     382                                <li><?php esc_html_e( 'Your original checkbox selections are saved in the background', 'security-header-generator' ); ?></li>
     383                            </ul>
     384                        </li>
     385                        <li><?php esc_html_e( 'When you turn WordPress Defaults OFF:', 'security-header-generator' ); ?>
     386                            <ul class="the_list">
     387                                <li><?php esc_html_e( 'WordPress default domains are removed', 'security-header-generator' ); ?></li>
     388                                <li><?php esc_html_e( 'Your original Extra Settings checkbox selections are restored', 'security-header-generator' ); ?></li>
     389                            </ul>
     390                        </li>
     391                        <li>
     392                            <strong><?php esc_html_e( 'Important:', 'security-header-generator' ); ?></strong> <?php esc_html_e( 'Changes only take effect when you click "Save Settings". Toggling WordPress Defaults on/off without saving will not permanently change your configuration.', 'security-header-generator' ); ?>
    393393                        </li>
    394394                    </ul>
    … …  
    397397        </li>
    398398       
    399         <li><h3><?php _e( 'Permissions Policy Tab', 'security-header-generator' ); ?></h3>
    400             <p><?php _e( 'Permissions Policy (formerly Feature Policy) controls which browser features and APIs your website and embedded content can use. This prevents malicious scripts from accessing sensitive features like camera, microphone, or geolocation.', 'security-header-generator' ); ?></p>
     399        <li><h3><?php esc_html_e( 'Permissions Policy Tab', 'security-header-generator' ); ?></h3>
     400            <p><?php esc_html_e( 'Permissions Policy (formerly Feature Policy) controls which browser features and APIs your website and embedded content can use. This prevents malicious scripts from accessing sensitive features like camera, microphone, or geolocation.', 'security-header-generator' ); ?></p>
    401401            <ul class="the_list">
    402402                <li>
    403                     <strong><?php _e( 'Configure Permissions Policy', 'security-header-generator' ); ?></strong>
    404                     <ul class="the_list">
    405                         <li>
    406                             <?php _e( 'Enable this to control browser feature permissions. For each feature, you can choose:', 'security-header-generator' ); ?>
    407                             <ul class="the_list">
    408                                 <li><strong>None:</strong> <?php _e( 'Block this feature completely', 'security-header-generator' ); ?></li>
    409                                 <li><strong>Any:</strong> <?php _e( 'Allow from any domain (least secure)', 'security-header-generator' ); ?></li>
    410                                 <li><strong>Self:</strong> <?php _e( 'Only allow from your own domain (recommended)', 'security-header-generator' ); ?></li>
    411                                 <li><strong>Source:</strong> <?php _e( 'Allow from specific domains you list', 'security-header-generator' ); ?></li>
    412                             </ul>
    413                         </li>
    414                         <li>
    415                             <?php _e( 'If you select "Source", enter full URLs with protocol: <code>https://example.com https://trusted-site.com</code>', 'security-header-generator' ); ?>
    416                         </li>
    417                         <li><?php _e( 'Learn more:', 'security-header-generator' ); ?> <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy</a></li>
    418                     </ul>
    419                 </li>
    420                 <li>
    421                     <strong><?php _e( 'Apply to Admin', 'security-header-generator' ); ?></strong>
    422                     <ul class="the_list">
    423                         <li><?php _e( 'Choose whether to apply Permissions Policy to your WordPress admin area as well as the public site.', 'security-header-generator' ); ?></li>
     403                    <strong><?php esc_html_e( 'Configure Permissions Policy', 'security-header-generator' ); ?></strong>
     404                    <ul class="the_list">
     405                        <li>
     406                            <?php esc_html_e( 'Enable this to control browser feature permissions. For each feature, you can choose:', 'security-header-generator' ); ?>
     407                            <ul class="the_list">
     408                                <li><strong>None:</strong> <?php esc_html_e( 'Block this feature completely', 'security-header-generator' ); ?></li>
     409                                <li><strong>Any:</strong> <?php esc_html_e( 'Allow from any domain (least secure)', 'security-header-generator' ); ?></li>
     410                                <li><strong>Self:</strong> <?php esc_html_e( 'Only allow from your own domain (recommended)', 'security-header-generator' ); ?></li>
     411                                <li><strong>Source:</strong> <?php esc_html_e( 'Allow from specific domains you list', 'security-header-generator' ); ?></li>
     412                            </ul>
     413                        </li>
     414                        <li>
     415                            <?php esc_html_e( 'If you select "Source", enter full URLs with protocol: <code>https://example.com https://trusted-site.com</code>', 'security-header-generator' ); ?>
     416                        </li>
     417                        <li><?php esc_html_e( 'Learn more:', 'security-header-generator' ); ?> <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy</a></li>
     418                    </ul>
     419                </li>
     420                <li>
     421                    <strong><?php esc_html_e( 'Apply to Admin', 'security-header-generator' ); ?></strong>
     422                    <ul class="the_list">
     423                        <li><?php esc_html_e( 'Choose whether to apply Permissions Policy to your WordPress admin area as well as the public site.', 'security-header-generator' ); ?></li>
    424424                    </ul>
    425425                </li>
    … …  
    429429   
    430430    <div class="technical-section">
    431         <h3><?php _e( 'Technical Reference: CSP Directives', 'security-header-generator' ); ?></h3>
    432         <p><em><?php _e( 'This section provides technical details about each Content Security Policy directive. These are automatically generated based on the plugin configuration.', 'security-header-generator' ); ?></em></p>
     431        <h3><?php esc_html_e( 'Technical Reference: CSP Directives', 'security-header-generator' ); ?></h3>
     432        <p><em><?php esc_html_e( 'This section provides technical details about each Content Security Policy directive. These are automatically generated based on the plugin configuration.', 'security-header-generator' ); ?></em></p>
    433433        <ul class="the_list">
    434434        <?php
    … …  
    448448        </ul>
    449449       
    450         <h3><?php _e( 'Technical Reference: Permissions Policy Directives', 'security-header-generator' ); ?></h3>
    451         <p><em><?php _e( 'This section provides technical details about each Permissions Policy directive. Note that browser support varies by directive.', 'security-header-generator' ); ?></em></p>
     450        <h3><?php esc_html_e( 'Technical Reference: Permissions Policy Directives', 'security-header-generator' ); ?></h3>
     451        <p><em><?php esc_html_e( 'This section provides technical details about each Permissions Policy directive. Note that browser support varies by directive.', 'security-header-generator' ); ?></em></p>
    452452        <ul class="the_list">
    453453        <?php

  • security-header-generator/trunk/work/inc/kcp-cspgen-common.php

    r3265831 r3420349  
    5454                    'desc' => __( 'Controls whether the current document is allowed to gather information about the acceleration of the device through the Accelerometer interface.', 'security-header-generator' ),
    5555                ),
     56                /* Commented out - limited browser support
    5657                'ambient-light-sensor' => array(
    5758                    'id' => 'fp_ambient-light-sensor',
    … …  
    5960                    'desc' => __( 'Controls whether the current document is allowed to gather information about the amount of light in the environment around the device through the AmbientLightSensor interface.', 'security-header-generator' ),
    6061                ),
     62                */
    6163                'autoplay' => array(
    6264                    'id' => 'fp_autoplay',
    … …  
    6466                    'desc' => __( 'Controls whether the current document is allowed to autoplay media requested through the HTMLMediaElement interface. When this policy is disabled and there were no user gestures, the Promise returned by HTMLMediaElement.play() will reject with a DOMException. The autoplay attribute on &lt;audio&gt; and &lt;video&gt; elements will be ignored.', 'security-header-generator' ),
    6567                ),
     68                'bluetooth' => array(
     69                    'id' => 'fp_bluetooth',
     70                    'title' => __( 'Bluetooth', 'security-header-generator' ),
     71                    'desc' => __( 'Controls whether the use of the Web Bluetooth API is allowed. When this policy is disabled, the methods of the Bluetooth object returned by Navigator.bluetooth will either return false or reject the returned Promise with a SecurityError DOMException.', 'security-header-generator' ),
     72                ),
    6673                'camera' => array(
    6774                    'id' => 'fp_camera',
    … …  
    6976                    'desc' => __( 'Controls whether the current document is allowed to use video input devices. When this policy is disabled, the Promise returned by getUserMedia() will reject with a NotAllowedError DOMException.', 'security-header-generator' ),
    7077                ),
     78                'captured-surface-control' => array(
     79                    'id' => 'fp_captured-surface-control',
     80                    'title' => __( 'Captured Surface Control', 'security-header-generator' ),
     81                    'desc' => __( 'Controls whether the Captured Surface Control feature can be used to programmatically manipulate a display surface being captured (such as a browser tab or window), including scrolling and zooming.', 'security-header-generator' ),
     82                ),
     83                'compute-pressure' => array(
     84                    'id' => 'fp_compute-pressure',
     85                    'title' => __( 'Compute Pressure', 'security-header-generator' ),
     86                    'desc' => __( 'Controls access to the Compute Pressure API, which allows monitoring of compute pressure (CPU, GPU) on the device.', 'security-header-generator' ),
     87                ),
     88                'cross-origin-isolated' => array(
     89                    'id' => 'fp_cross-origin-isolated',
     90                    'title' => __( 'Cross Origin Isolated', 'security-header-generator' ),
     91                    'desc' => __( 'Controls whether the document is cross-origin isolated, enabling certain powerful features like SharedArrayBuffer and high-precision timers.', 'security-header-generator' ),
     92                ),
     93                'deferred-fetch' => array(
     94                    'id' => 'fp_deferred-fetch',
     95                    'title' => __( 'Deferred Fetch', 'security-header-generator' ),
     96                    'desc' => __( 'Controls whether the current document is allowed to use the fetchLater() API to defer fetch requests until after the document is unloaded.', 'security-header-generator' ),
     97                ),
     98                'deferred-fetch-minimal' => array(
     99                    'id' => 'fp_deferred-fetch-minimal',
     100                    'title' => __( 'Deferred Fetch Minimal', 'security-header-generator' ),
     101                    'desc' => __( 'Controls whether the current document is allowed to use the fetchLater() API with minimal quota restrictions.', 'security-header-generator' ),
     102                ),
    71103                'display-capture' => array(
    72104                    'id' => 'fp_display-capture',
    … …  
    111143                ),
    112144               
     145                /* Commented out - limited browser support
    113146                'magnetometer' => array(
    114147                    'id' => 'fp_magnetometer',
    … …  
    116149                    'desc' => __( 'Controls whether the current document is allowed to gather information about the orientation of the device through the Magnetometer interface', 'security-header-generator' ),
    117150                ),
     151                */
    118152                'microphone' => array(
    119153                    'id' => 'fp_microphone',
    … …  
    126160                    'desc' => __( 'Controls whether the current document is allowed to use the Web MIDI API. When this policy is disabled, the Promise returned by Navigator.requestMIDIAccess() will reject with a DOMException', 'security-header-generator' ),
    127161                ),
     162                'otp-credentials' => array(
     163                    'id' => 'fp_otp-credentials',
     164                    'title' => __( 'OTP Credentials', 'security-header-generator' ),
     165                    'desc' => __( 'Controls whether the current document is allowed to use the WebOTP API to request a one-time password (OTP) from a specially-formatted SMS message sent by the app\'s server.', 'security-header-generator' ),
     166                ),
    128167                'payment' => array(
    129168                    'id' => 'fp_payment',
    … …  
    138177                'publickey-credentials-create' => array(
    139178                    'id' => 'fp_publickey-credentials-create',
    140                     'title' => __( 'Publicket Credentials Create', 'security-header-generator' ),
     179                    'title' => __( 'Publickey Credentials Create', 'security-header-generator' ),
    141180                    'desc' => __( 'Controls whether the current document is allowed to use the Web Authentication API to create new WebAuthn credentials, i.e., via navigator.credentials.create({publicKey}).', 'security-header-generator' ),
    142181                ),
    143182                'publickey-credentials-get' => array(
    144183                    'id' => 'fp_publickey-credentials-get',
    145                     'title' => __( 'Publicket Credentials Get', 'security-header-generator' ),
     184                    'title' => __( 'Publickey Credentials Get', 'security-header-generator' ),
    146185                    'desc' => __( 'Controls whether the current document is allowed to use the Web Authentication API to retrieve already stored public-key credentials, i.e. via navigator.credentials.get({publicKey: ..., ...})', 'security-header-generator' ),
    147186                ),
    … …  
    156195                    'desc' => __( 'Controls whether the current document is allowed to use the Web Serial API to communicate with serial devices, either directly connected via a serial port, or via USB or Bluetooth devices emulating a serial port.', 'security-header-generator' ),
    157196                ),
     197                'storage-access' => array(
     198                    'id' => 'fp_storage-access',
     199                    'title' => __( 'Storage Access', 'security-header-generator' ),
     200                    'desc' => __( 'Controls whether a document loaded in a third-party context (i.e. embedded in an &lt;iframe&gt;) is allowed to use the Storage Access API to request access to unpartitioned cookies.', 'security-header-generator' ),
     201                ),
     202                /* Commented out - limited browser support
    158203                'sync-xhr' => array(
    159204                    'id' => 'fp_sync-xhr',
    … …  
    161206                    'desc' => __( 'Controls whether the current document is allowed to make synchronous XMLHttpRequest requests', 'security-header-generator' ),
    162207                ),
     208                */
    163209                'usb' => array(
    164210                    'id' => 'fp_usb',
    … …  
    170216                    'title' => __( 'Web Share', 'security-header-generator' ),
    171217                    'desc' => __( 'Controls whether the current document is allowed to use the Navigator.share() method of the Web Share API to share text, links, images, and other content to arbitrary destinations of the user\'s choice.', 'security-header-generator' ),
     218                ),
     219                'window-management' => array(
     220                    'id' => 'fp_window-management',
     221                    'title' => __( 'Window Management', 'security-header-generator' ),
     222                    'desc' => __( 'Controls whether the current document is allowed to use the Window Management API to manage windows on multiple displays.', 'security-header-generator' ),
    172223                ),
    173224                'xr-spatial-tracking' => array(

  • security-header-generator/trunk/work/inc/kcp-cspgen-settings.php

    r3420274 r3420349  
    133133                        'title'  => __( 'Standard Security Headers', 'security-header-generator' ),
    134134                        'fields' => $this -> kcp_standard_security_headers( ),
    135                         'description' => __( '<p><strong>NOTE</strong><br />Make sure to check your web browsers <strong>Development Tools</strong> once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.</p>', 'security-header-generator' ),
     135                        'description' => __( '<p>NOTE<br />Make sure to check your web browsers Development Tools once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.</p>', 'security-header-generator' ),
    136136                    )
    137137                );
    … …  
    142142                        'title'  => __( 'Content Security Headers', 'security-header-generator' ),
    143143                        'fields' => $this -> kcp_content_security_policy_headers( ),
    144                         'description' => __( '<p><strong>NOTE</strong><br />Make sure to check your web browsers <strong>Development Tools</strong> once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.<br /><br /><strong>Suggested:</strong><br />Add your domains to the necessary attribute prior to adding the external resource...</p>', 'security-header-generator' ),
     144                        'description' => __( '<p>NOTE<br />Make sure to check your web browsers Development Tools once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.<br /><br />Suggested:<br />Add your domains to the necessary attribute prior to adding the external resource...</p>', 'security-header-generator' ),
    145145                        'class' => 'wpsh_content_security_policy'
    146146                    )
    … …  
    152152                        'title'  => __( 'Permissions Policy Headers', 'security-header-generator' ),
    153153                        'fields' => $this -> kcp_permissions_policy_headers( ),
    154                         'description' => __( '<p><strong>NOTE</strong><br />Make sure to check your web browsers <strong>Development Tools</strong> once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.</p>', 'security-header-generator' ),
     154                        'description' => __( '<p>NOTE<br />Make sure to check your web browsers Development Tools once you are finished configuring this. You will need to make sure you are not blocking necessary items for your website.</p>', 'security-header-generator' ),
    155155                    )
    156156                );
    … …  
    217217                    'type' => 'switcher',
    218218                    'title' => __( 'Apply to the REST API?', 'security-header-generator' ),
    219                     'desc' => __( 'This will attempt to apply all headers to the REST API of your site.<br /><strong>NOTE:</strong> Due to the default nature of the REST API, the headers will also be applied to the admin areas of the website. You will need to check for breakages after applying.', 'security-header-generator' ),
     219                    'desc' => __( 'This will attempt to apply all headers to the REST API of your site.<br />NOTE: Due to the default nature of the REST API, the headers will also be applied to the admin areas of the website. You will need to check for breakages after applying.', 'security-header-generator' ),
    220220                    'default' => false,
    221221                ),
    … …  
    245245                    'id' => 'include_sts_subdomains',
    246246                    'type' => 'switcher',
    247                     'title' => __( '<strong>Include Subdomains?</strong>', 'security-header-generator' ),
     247                    'title' => __( 'Include Subdomains?', 'security-header-generator' ),
    248248                    'desc' => __( 'If this optional parameter is specified, this rule applies to all of the site\'s subdomains as well.', 'security-header-generator' ),
    249249                    'default' => false,
    … …  
    255255                    'id' => 'include_sts_preload',
    256256                    'type' => 'switcher',
    257                     'title' => __( '<strong>Preload?</strong>', 'security-header-generator' ),
     257                    'title' => __( 'Preload?', 'security-header-generator' ),
    258258                    'desc' => __( 'If you enable preload, you should change the cache age to 2 Years. (63072000)', 'security-header-generator' ),
    259259                    'default' => false,
    … …  
    267267                    'type' => 'switcher',
    268268                    'title' => __( 'Enforce Certificate Transparency?', 'security-header-generator' ),
    269                     'desc' => __( 'Setting this will add another header to enforce Certificate Transparency. See here for more information: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT</a><br /><strong>NOTE: </strong>This header is likely to be deprecated in the near future.', 'security-header-generator' ),
     269                    'desc' => __( 'Setting this will add another header to enforce Certificate Transparency. See here for more information: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT</a><br />NOTE: This header is likely to be deprecated in the near future.', 'security-header-generator' ),
    270270                    'default' => false,
    271271                ),
    … …  
    308308                    'type' => 'checkbox',
    309309                    'title' => __( 'Methods', 'security-header-generator' ),
    310                     'desc' => __( 'Select the methods you wish to allow.<br /><strong>NOTE:</strong> Most public websites require at least GET to be viewable online.<br /><strong>NOTE 2:</strong> This will block unselected methods.', 'security-header-generator' ),
     310                    'desc' => __( 'Select the methods you wish to allow.<br />NOTE: Most public websites require at least GET to be viewable online.<br />NOTE 2: This will block unselected methods.', 'security-header-generator' ),
    311311                    'options' => array(
    312312                        'GET' => __( 'GET', 'security-header-generator' ),
    … …  
    349349                    'type' => 'text',
    350350                    'title' => __( 'Origin', 'security-header-generator' ),
    351                     'desc' => __( 'Set the allowed access origin here.  Can either be an asterisk: <code>*</code>, or a FQDN URL: <code>https://example.com</code><br /><strong>NOTE: </strong>If nothing is put in here, we will default to <code>*</code>', 'security-header-generator' ),
     351                    'desc' => __( 'Set the allowed access origin here.  Can either be an asterisk: <code>*</code>, or a FQDN URL: <code>https://example.com</code><br />NOTE: If nothing is put in here, we will default to <code>*</code>', 'security-header-generator' ),
    352352                    'dependency' => array( 'include_acao', '==', true ),
    353353                ),
    … …  
    550550                    'id' => 'auth_un',
    551551                    'type' => 'text',
    552                     'title' => __( '<strong>Basic Auth Username</strong>', 'security-header-generator' ),
     552                    'title' => __( 'Basic Auth Username', 'security-header-generator' ),
    553553                    'desc' => __( 'Enter your Basic Auth Username, if your site has this protection. (aka: htaccess protection, or htpasswd', 'security-header-generator' ),
    554554                    'dependency' => array( 'generate_csp', '==', true ),
    … …  
    562562                    'type' => 'text',
    563563                    'attributes' => array( 'type' => 'password', 'autocomplete' => 'new-password' ),
    564                     'title' => __( '<strong>Basic Auth Password</strong>', 'security-header-generator' ),
     564                    'title' => __( 'Basic Auth Password', 'security-header-generator' ),
    565565                    'desc' => __( 'Enter your Basic Auth Password, if your site has this protection. (aka: htaccess protection, or htpasswd', 'security-header-generator' ),
    566566                    'dependency' => array( 'generate_csp', '==', true ),
    … …  
    699699                    'type' => 'switcher',
    700700                    'title' => __( 'Do you want to configure a Feature Policy (aka Permissions-Policy)?', 'security-header-generator' ),
    701                     'desc' => __( 'Setting this will add another header to configure browser and frame permissions. See here for more information: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy</a><br /><br /><strong>NOTE: </strong> Some of these features are not implemented for all browsers, and/or could be experimental.  Please read through that information and decide what features you need, and what audiences you need to apply to.', 'security-header-generator' ),
     701                    'desc' => __( 'Setting this will add another header to configure browser and frame permissions. See here for more information: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy" target="_blank">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy</a><br /><br />NOTE: Some of these features are not implemented for all browsers, and/or could be experimental.  Please read through that information and decide what features you need, and what audiences you need to apply to.', 'security-header-generator' ),
    702702                    'default' => false,
    703703                ),
Note: See TracChangeset for help on using the changeset viewer.