“Missing security headers” on WordPress Site Health page

@doffine,

Thanks for you input. I agree with you. Our usual practice is to offer users the option to do it themselves, and as alternative give an option to upgrade.

This first option is missing on this page, which is not how it should be.

To get get rid of the notice, you can select on ore more of the following headers to add to your .htaccess:

Header always set Strict-Transport-Security: "max-age=31536000" env=HTTPS
Header always set X-XSS-Protection "1; mode=block"'
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy: "no-referrer-when-downgrade"
Header always set Expect-CT "max-age=7776000, enforce"
Header always set X-Frame-Options "sameorigin"
Header always set Content-Security-Policy "upgrade-insecure-requests"

I will update the article accordingly.

Let me know if that works for you.

Add those in *WHERE* in .htaccess!?

Because adding them in anywhere – from the beginning to inside your RS SSL coding to tacking on the end – resulted in a 500 error.

Honestly, rather than upgrading to pro… I think it’d be easier to just delete the plugin and move on to something that’s not hell bent on trying to separate me from my $$$

Regarding (copied verbatim):

Header always set Strict-Transport-Security: "max-age=31536000" env=HTTPS
Header always set X-XSS-Protection "1; mode=block"'
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy: "no-referrer-when-downgrade"
Header always set Expect-CT "max-age=7776000, enforce"
Header always set X-Frame-Options "sameorigin"
Header always set Content-Security-Policy "upgrade-insecure-requests"

Wild goose chase: the apostrophe [‘] renders your suggested changes unusable.

Sorry about the apostrophe. A copy paste error. Without apostrophe, for community purposes:

Header always set Strict-Transport-Security: "max-age=31536000" env=HTTPS
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy: "no-referrer-when-downgrade"
Header always set Expect-CT "max-age=7776000, enforce"
Header always set X-Frame-Options "sameorigin"
Header always set Content-Security-Policy "upgrade-insecure-requests"

@rogierlankhorst,

first thanks for coming back.

We don’t want to change the .htaccess even with only one of these lines just to get rid off your plugin’s notification in the Site Health page.

We just want that your plugin doesn’t push this notification into WordPress’ Site Health page.

Or at least it should be possible to switch that off via a setting in your plugin or via a filter.

Again: We are a web agency maintaining 200+ completely different WordPress installations with several hundrets of different plugins. Not a single one of them uses the Site Health page in this way.

To be precise: Every single of our 200+ Site Health pages show the check mark and 0 problems to be solved.

Now every single Site Health page shows just your note and we simply don’t want to upgrade to premium and also we don’t want to add only a single line to the .htaccess. The .htaccess are exactly as they should be. We won’t change them only to silence your plugin.

It would really be more than enough if your plugin would inform the admin on your own plugin pages about these additional possible security features and not to hijack the Site Health page for ad purposes. I would be interested in what www.remarpro.com staff would say to this behaviour.

So what can we / you do here to solve that. We else really would consider removing your plugin and replacing it.

Greetings,
-doffine

Hi @doffine,

We are releasing a maintenance release today where you can use the “dismiss all Really Simple SSL notices” to dismiss the notice (4.0.2).

@rogierlankhorst,

thank you very much. That is a solution we can live with.
Unfortunately the solution currently has a bug. We’ll open another thread for this.

This one here is resolved.

Greetings,
-doffine

Hi @doffine,

Ah, I see the problem. We’ll release a fix tomorrow. Thanks for reporting it.

@rogierlankhorst,

ok then. Thank you very much.

I reported this bug with detailed information in this forum but the new thread didn’t get published so far. So don’t be surprised that I “will be” reporting it again here, if it should appear here after all.

Greetings,
-doffine