Carl

Hello,

Could you confirm have selected the “Force XSS protection” option?

Regards,
Carl

Some cache plugins completely rewrite the http headers, you may have to rewrite manually your .htaccess file with the contents of the .htaccess tab.

Carl

Does the console or the error.log mention some conflict? You need to give extra care if you activate the CSP options as this can prevent the loading of external resources.

Carl

This is probably due to a plug-in or a theme that directly write the headers. The plug-in addresses this within the .htaccess tab in the settings. It provides you with the content to write into your .htaccess file and provides an option “Disable header rewriting”.

This should address your issue.

Carl

Hi,

The “right configuration” depends on your needs or goals. This said, you can test your site with securityheaders.com.

Carl

We need to check what that implies.

I think I understand the issue. Currently, prints can not be managed as variable products.

Can you send me a link to the product page that loads Creator Five?

Carm

Hi Johannes and thanks for your feedback,

I’ve added support for multiple content security policies on the development list. This said, adding additional policies can only further restrict the capabilities of the protected resource.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#Multiple_content_security_policies

Regards,
Carl

HI,

In fact they are sent in the HTTP headers (before the HTML content of a page). The .htaccess content is provided in case of conflict with cache plug-ins.

Regards,
Carl

Hi Sebastian,

Thanks for the suggestion. The first version implemented the list under the Directives header. The remaining features will be integrated soon.

Carl

Hello, thanks for your nice comments on the plug-in.

Yes, unfortunately as mentionned in other threads, there is not much to do with plug-ins that remove the headers. This said, the plug-in now genetares the content that you can add to your .htaccess. It is not complete by now but it is the only workaround solution.

Carl

Thanks, it works fine. In fact, I was suspicious because there is no added mention of “Privacy Policy Page” in the administration of the pages.

Gorgeous!

Hi Nico,

I found this advice in numerous security related blogs some time ago and it has become my habit… Probably because it becomes unreadable from HTTP requests.

Carl