About this plugin
AiutoComputerHelp HTTP Header Audit checks HTTP response headers returned by the current WordPress site and highlights security controls that deserve review.
The plugin is intentionally read-only. htaccess, Apache, Nginx, CDN, reverse proxy, browser policies, or server configuration.
org review. The existing checks cover: HTTPS, HTTP-to-HTTPS redirection, redirect-chain integrity, HSTS, Content-Security-Policy, CSP Report-Only, clickjacking protection, X-Content-Type-Options, Content-Type and charset, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, cross-origin isolation prerequisites, basic CORS exposure, Cache-Control, cookie attributes, information disclosure headers, selected obsolete security headers, and obvious conflicting singleton policies.
CSP analysis looks beyond presence or absence. It reviews high-signal conditions such as unsafe-eval, unsafe-inline without a nonce or hash, wildcard script sources, object-src, base-uri, and frame-ancestors.
The audit uses four result states: Pass, Review, Warning, and Info. A missing header is not automatically a vulnerability, and a present header does not prove that a site is secure. Some policies are application-specific deployment choices.
The plugin intentionally does not calculate a numeric security score.
For safety, the audit accepts only URLs on the current WordPress site’s host and follows redirects only while they remain on that host.
Cookie auditing checks objective Set-Cookie attribute relationships and prefix requirements without exposing cookie values. The absence of Secure, HttpOnly, or SameSite is not automatically treated as a vulnerability because the correct choice depends on the cookie’s purpose.
Active origin-reflection probing, preflight simulation, deep CORS authorization testing, Clear-Site-Data, scheduled monitoring, and configuration suggestions remain outside the scope of this plugin. Basic CORS analysis validates response-header syntax and a few objective incompatibilities without assuming that public wildcard access or a specific allowed origin is inherently unsafe.