Title: Gmcfuerte Security Headers
Author: GMC Fuerte — Giulio Maria Cappellano
Published: <strong>15 اکتبر 2026</strong>
Last modified: 15 اکتبر 2026

---

جستجوی افزونه‌ها

![](https://s.w.org/plugins/geopattern-icon/gmcfuerte-security-headers.svg)

# Gmcfuerte Security Headers

 توسط [GMC Fuerte — Giulio Maria Cappellano](https://profiles.wordpress.org/gmcfuerte/)

[دانلود](https://downloads.wordpress.org/plugin/gmcfuerte-security-headers.1.0.1.zip)

 * [جزئیات](https://fa.wordpress.org/plugins/gmcfuerte-security-headers/#description)
 * [نقد و بررسی‌ها](https://fa.wordpress.org/plugins/gmcfuerte-security-headers/#reviews)
 *  [نصب](https://fa.wordpress.org/plugins/gmcfuerte-security-headers/#installation)
 * [توسعه](https://fa.wordpress.org/plugins/gmcfuerte-security-headers/#developers)

 [پشتیبانی](https://wordpress.org/support/plugin/gmcfuerte-security-headers/)

## توضیحات

Gmcfuerte Security Headers adds the security headers that scanners and hosting audits
expect, without editing the
 web server configuration, and tells you in plain words
what each header does.

What it sends (each one can be switched off):

 * X-Content-Type-Options: nosniff
 * X-Frame-Options: SAMEORIGIN (or DENY)
 * Referrer-Policy: strict-origin-when-cross-origin (or strict-origin, same-origin,
   no-referrer)
 * Permissions-Policy: Basic preset (camera, microphone and location off, also in
   embedded maps and video) or Strict preset
 * Strict-Transport-Security (HSTS): off by default, opt-in with a clear warning,
   max-age from 5 minutes to 1 year, optional includeSubDomains; sent on HTTPS requests
   only
 * Removes the X-Powered-By header that reveals your PHP version

Values come from short lists of safe choices, so a typing mistake cannot break your
site.

Never twice: a header that WordPress, another plugin or your .htaccess file already
sets keeps its value. The plugin
 only adds what is missing, and the settings page
names the headers it leaves to your .htaccess file.

Self-check: one click reads the headers your home page really sends (including those
set by the server, the
 .htaccess file or other plugins) and shows, for each one,
its status (OK, missing, sent twice, weak, reveals information), the value received
and what it means.

The plugin stores one option with your choices. It sets no cookies and does not 
collect personal data.

A Pro edition adds a Content-Security-Policy with a Report-Only rollout and script
nonces, free-form policy values,
 HSTS preload with reverse-proxy checks and 404
responses for version-revealing files. This free plugin works on its own and does
not need it. If both are active, this plugin sends nothing and says so on its settings
page. The Pro sends headers only with a valid licence, so run the self-check to 
see what your site really sends. Settings do not carry over.

### External services

This plugin does not connect to any external service. The self-check, only when 
an administrator clicks
 “Run the self-check”, makes one HTTP request from your 
server to your own home page (plus at most three redirects on the same site) to 
read its response headers. No data is sent to third parties.

## نصب

 1. Upload the `gmcfuerte-security-headers` folder to `/wp-content/plugins/`, or install
    the ZIP from Plugins -> Add New -> Upload Plugin.
 2. Activate the plugin through the Plugins screen.
 3. Open Settings -> Gmcfuerte Security Headers, check the choices and click Save Changes.
 4. Click “Run the self-check” to see what your home page sends.

## سوالات متداول

### Will it break my site?

The defaults suit most sites, with two points to check:

 * The Basic Permissions-Policy, on by default, turns off camera, microphone and
   location for your pages and for
    everything embedded in them. Maps that locate
   the visitor (including the “my location” button of an embedded map), video calls,
   voice input and QR scanners stop working. If your site uses any of them, set 
   Permissions-Policy to Off.
 * X-Frame-Options stops other sites from showing your pages in a frame: switch 
   it off if another site of yours
    embeds these pages.

The Strict Permissions-Policy preset also blocks browser payment buttons (Apple 
Pay, Google Pay): do not use Strict on
 shops that use them.

### Why does the self-check still show a header as missing?

Headers are added by PHP. A page cache that serves stored pages without running 
PHP, or a CDN, may drop them. Some
 headers may also be left to your .htaccess file(
the settings page lists them): if your server ignores the .htaccess file or lacks
mod_headers, they are not sent. While the Pro edition is active this plugin sends
nothing, and the Pro sends headers only with a valid licence.

### Why is a header “sent twice”?

Two layers set it, for example the server configuration and a plugin. This plugin
never adds a header that is
 already present in PHP or declared in your .htaccess
file, but it cannot see headers that the server or a proxy adds on its own. Keep
one source.

### Should I turn on HSTS?

Only when every page and file of your site works over HTTPS. Browsers that receive
HSTS refuse plain HTTP for your
 domain for the whole max-age, and turning the setting
off does not undo that. Start with 5 minutes, then raise it.

### Does it add a Content-Security-Policy?

No. A Content-Security-Policy has to be tuned to the scripts and services each site
uses. The self-check tells you
 whether your site sends one.

## نقد و بررسی‌ها

نقد و بررسی‌ای برای این افزونه یافت نشد.

## توسعه دهندگان و همکاران

“Gmcfuerte Security Headers” نرم افزار متن باز است. افراد زیر در این افزونه مشارکت
کرده‌اند.

مشارکت کنندگان

 *   [ GMC Fuerte — Giulio Maria Cappellano ](https://profiles.wordpress.org/gmcfuerte/)

[ترجمه “Gmcfuerte Security Headers” به زبان شما.](https://translate.wordpress.org/projects/wp-plugins/gmcfuerte-security-headers)

### علاقه‌ مند به توسعه هستید؟

[کد را مرور کنید](https://plugins.trac.wordpress.org/browser/gmcfuerte-security-headers/)،
[مخزن SVN](https://plugins.svn.wordpress.org/gmcfuerte-security-headers/) را بررسی
کنید، یا از طریق [RSS](https://plugins.trac.wordpress.org/log/gmcfuerte-security-headers/?limit=100&mode=stop_on_copy&format=rss)
در [گزارش توسعه](https://plugins.trac.wordpress.org/log/gmcfuerte-security-headers/)
مشترک شوید.

## گزارش تغییرات

#### 1.0.1

 * Use WordPress.org language packs and automatic translation loading. Translation
   source files are maintained separately for translate.wordpress.org; they are 
   no longer bundled in the plugin ZIP.
 * Security header behaviour and saved settings are unchanged. English is used when
   a language pack is not installed.

#### 1.0.0

 * First release: nosniff, X-Frame-Options, Referrer-Policy and Permissions-Policy
   presets, opt-in HSTS, X-Powered-By removal, gap-filling rule (never sent twice),
   read-only self-check, translations in Italian, Spanish and French.

## اطلاعات

 *  نگارش **1.0.1**
 *  آخرین به‌روزرسانی **4 روز پیش**
 *  نصب‌های فعال **کمتر از 10**
 *  نگارش وردپرس ** 6.3 یا بالاتر **
 *  آزمایش‌شده تا **7.1.3**
 *  نگارش PHP ** 8.1 یا بالاتر **
 *  زبان
 * [English (US)](https://wordpress.org/plugins/gmcfuerte-security-headers/)
 * برچسب
 * [hsts](https://fa.wordpress.org/plugins/tags/hsts/)[permissions policy](https://fa.wordpress.org/plugins/tags/permissions-policy/)
   [referrer-policy](https://fa.wordpress.org/plugins/tags/referrer-policy/)[Security Headers](https://fa.wordpress.org/plugins/tags/security-headers/)
   [x-frame-options](https://fa.wordpress.org/plugins/tags/x-frame-options/)
 *  [نمایش پیشرفته](https://fa.wordpress.org/plugins/gmcfuerte-security-headers/advanced/)

## امتیازها

هنوز هیچ نقدی ارسال نشده است.

[بررسی شما](https://wordpress.org/support/plugin/gmcfuerte-security-headers/reviews/#new-post)

[مشاهدهٔ همهٔ بررسی‌ها](https://wordpress.org/support/plugin/gmcfuerte-security-headers/reviews/)

## مشارکت کنندگان

 *   [ GMC Fuerte — Giulio Maria Cappellano ](https://profiles.wordpress.org/gmcfuerte/)

## پشتیبانی

چیزی برای گفتن دارید؟ نیاز به کمک دارید؟

 [مشاهده انجمن پشتیبانی](https://wordpress.org/support/plugin/gmcfuerte-security-headers/)