FlatPress Protect
=================

Description
-----------
Protect your blog with additional fetures in the HTTP response header

 * Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources for approved content, you can prevent the browser from loading malicious content.
 * Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
 * HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
 * The X-Download-Options response header instructs the browser not to open the file directly but to offer it for download first. This mitigates some potential Social Engineering attacks.
 * HTTP Strict Transport Security (HSTS for short) is a security mechanism for HTTPS connections that protects against both connection encryption downgrade attack and session hijacking.
 * The referrer policy directive determines whether, and if so which, referrer information for requests triggered by the current web page is sent by the web browser in HTTP requests.

Important note: HTTPS should have been mandatory long ago!
----------------------------------------------------------
The CSP directives enforce the use of HTTPS.
Therefore we recommend you to encrypt the HTTP data stream. For this, the web server needs an SSL certificate.
These are usually chargeable, but since Mozilla launched the "Let's encrypt!" initiative, such certificates are now also available for free, depending on the hosting partner.

Default settings
----------------
By default, the editing option of the .htaccess file is hidden in the PrettyURLs plugin to protect this file from unwanted changes.
With the FlatPress Protect plugin, you can allow access to the .htaccess edit field.

By default, the execution of insecure Java scripts is blocked in your blog visitor's browser.
If you want to use a plugin with insecure integration, you can activate this option with this plugin.

We recommend using a nonce to securely integrate the Java script in question.
An example in PHP:
$random_hex = RANDOM_HEX;
echo '<script nonce="' . $random_hex . '" src=" ...

An example for the Smarty template:
<script nonce="{$smarty.const.RANDOM_HEX}" src=" ...

Here you can check the security of your FlatPress blog
https://securityheaders.com/
