igorhrcek / wp-cli-secure-command

Secure package for WP CLI, built to provide an easier way of securing your WordPress installation

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Implement the ability to scan for and set security headers

igorhrcek opened this issue · comments

Is your feature request related to a problem? Please describe.
No

Describe the solution you'd like
We need to implement a command that will allow us to search for certain security headers, output the result of the search and allow user to set most frequently used security headers

Describe alternatives you've considered
None

Additional context
Because of the complexity of this command we are going to do implementation in two steps:

  1. We are going to perform search-only
  2. We are going to write rules into config files

We haven't agreed really on the list of headers that we want to scan for (and provide rules for) but I think that we should go with:

  1. HSTS (Strict-Transport-Security)
  2. X-XSS
  3. X-Frame-Options
  4. X-Content-Type-Options
  5. Referrer-Policy (maybe to consider)

I propose that the command for this should be something like:

wp secure securityheaders --scan
wp secure securityheaders --deploy=hsts
wp secure securityheaders --remove=hsts

For scan I prefer to use a table output with the following columns:

  1. Header name
  2. Value (present, not present)

🎉 This issue has been resolved in version 1.13.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀