gobbetto

test result:

red problem

HTTP Strict Transport Security (HSTS)
Not Found
Recommended: includeSubDomains; preload; max-age=63072000

Permissions-Policy
Not Found
Recommended: Do not use *. e.g. for the camera feature: camera=(‘self’), camera=() or camera=(‘yourdomain.com’)

yellow problem

Referrer-Policy
Content: same-origin
Recommended: strict-origin-when-cross-origin

X-XSS-Protection
Content: 1; mode=block
Recommended: 0

the other are ok

thanks

• This reply was modified 1 year, 10 months ago by gobbetto.

ok thanks, i will see how to do it and if i find this help

After the changes made the site works
but in the wordpress improvement checks i still get the warning to fix the security headers
In practice, with the changes made, nothing has changed
thank you

hi, i asked my host and he told me to do the following changes:
create a .user.ini file with inside auto_prepend_file = "/home/mhd/www.aeki.biz/htdocs/prepend_headers.php"

then create a file named prepend_headers.php with inside this code

<?php
header('X-XSS-Protection: 1; mode=block');
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: same-origin');
header('Content-Security-Policy: upgrade-insecure-requests');

and they told me to leave the changes in the htaccess file as well

after all these operations the problem persists
how do i solve it?
thank you

i will try

thanks a lot

thanks for your help, suddenly today the Domain Key code appeared without having made any changes

however I see that the plug-in and the QUIC.cloud have a lot of settings that are very complicated for me

I think I’ll have to drop out

thank you very much for helping

ok, thanks, i think i will remove the plug-in

thank you so much for trying and helping

ok, thanks

thanks for your answer,

in the link page, if I understand correctly, there are three different solutions for three different problems
I don’t understand if and which one is right for me

– my site already has an address in https
– I’m not sure If have Webfonts from Google
– I have no subdomains

could you give me some more advice?

Thank you

thanks for your answer

oh god, that’s a lot to understand

I hope to understand something and find the solution

thank you

i think it is a shared host

I use tophost with the topweb plus plan

i tried putting that code at the beginning of the wp-config.php file
but I don’t know if it helped …

thank you

• This reply was modified 2 years, 10 months ago by gobbetto.

I’m sorry, I’m not an expert and I struggle to understand these technical things

I asked my host and he told me to insert the following instruction at the beginning of the PHP input file (e.g. index.php or the configuration file):

$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];

would doing this solve the problem?

Thanks for the availability

thanks for your answer,

I’m sorry but I don’t know how to enable mod_remoteip in apache

could you give me some more info or a link where to find an explanation?

thank you

ok, thanks a lot !

i did it:

Report number: MSMMGOQC

Report date: 01/10/2022 10:49:16

then i did not understand the previous message

could you please be clearer?

I have to make some changes or you will solve it
or what else?

Thanks so much