No upgrade notices available yet.<\/p>"},"ratings":[],"assets_icons":{"icon.svg":{"filename":"icon.svg","revision":3263313,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3263396,"resolution":"1544x500","location":"assets","locale":""},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3263396,"resolution":"772x250","location":"assets","locale":""}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1","1.0.2","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3383869,"resolution":"1","location":"assets","locale":""},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3383869,"resolution":"2","location":"assets","locale":""},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3383869,"resolution":"3","location":"assets","locale":""},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3383869,"resolution":"4","location":"assets","locale":""},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3383869,"resolution":"5","location":"assets","locale":""}},"screenshots":{"1":"The dashboard gives you an overview of your site's current ratings, scan history and benchmark comparison.","2":"The dashboard gives you an overview of your site's current ratings, scan history and benchmark comparison.","3":"The dashboard gives you an overview of your site's current ratings, scan history and benchmark comparison.","4":"WordSentinel lets you configure which header is active.","5":"Advanced CSP configuration panel, in this tab you can whitelist the external resources and assure a fully functional website without lowering the level of protection."},"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[7642,19966,2846,153786,1536],"plugin_category":[54],"plugin_contributors":[249468,249467,249658,249466],"plugin_business_model":[],"class_list":["post-223522","plugin","type-plugin","status-closed","hentry","plugin_tags-clickjacking","plugin_tags-csp","plugin_tags-headers","plugin_tags-security-headers","plugin_tags-ssl","plugin_category-security-and-spam-protection","plugin_contributors-guerricm","plugin_contributors-maxouhell","plugin_contributors-nexsol","plugin_contributors-victorlago","plugin_committers-guerricm","plugin_committers-maxouhell","plugin_committers-nexsol","plugin_committers-victorlago"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/wordsentinel\/assets\/icon.svg?rev=3263313","icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/wordsentinel_ffffff.svg","icon_2x":false,"generated":true},"screenshots":[{"src":"https:\/\/ps.w.org\/wordsentinel\/assets\/screenshot-1.png?rev=3383869","caption":"The dashboard gives you an overview of your site's current ratings, scan history and benchmark comparison."},{"src":"https:\/\/ps.w.org\/wordsentinel\/assets\/screenshot-2.png?rev=3383869","caption":"The dashboard gives you an overview of your site's current ratings, scan history and benchmark comparison."},{"src":"https:\/\/ps.w.org\/wordsentinel\/assets\/screenshot-3.png?rev=3383869","caption":"The dashboard gives you an overview of your site's current ratings, scan history and benchmark comparison."},{"src":"https:\/\/ps.w.org\/wordsentinel\/assets\/screenshot-4.png?rev=3383869","caption":"WordSentinel lets you configure which header is active."},{"src":"https:\/\/ps.w.org\/wordsentinel\/assets\/screenshot-5.png?rev=3383869","caption":"Advanced CSP configuration panel, in this tab you can whitelist the external resources and assure a fully functional website without lowering the level of protection."}],"raw_content":"\n
The WordSentinel<\/strong> plugin by Nexsol Technologies S\u00e0rl<\/strong> enhances your WordPress website\u2019s security by automatically applying and managing HTTP security headers<\/strong> \u2014 including Content Security Policy (CSP)<\/strong> \u2014 while providing live security analysis powered by Mozilla Observatory<\/strong>.<\/p>\n\n Unlike simple header managers, WordSentinel actively helps you understand, measure, and improve your site\u2019s protection. WordSentinel helps protect your WordPress website against common web vulnerabilities such as:\n- Cross-Site Scripting (XSS<\/strong>) It does so by implementing a complete and configurable set of browser-level security headers<\/strong>, giving you granular control over each directive.<\/p>\n\n In addition, it connects securely to Mozilla Observatory<\/strong> to scan your site and assign a security grade<\/strong> (A+ to F), helping you benchmark your configuration and understand what needs improvement.<\/p>\n\n Comprehensive HTTP Header Management<\/strong> Real-Time Security Analysis<\/strong> Advanced CSP Management<\/strong> Smart License and Subscription System<\/strong> Optimized for Local and Production Environments<\/strong> Performance and Privacy First<\/strong> Multilingual and Accessible Interface<\/strong> WordSentinel merges modern web security standards with a simple and intuitive configuration experience \u2014 making it a must-have for both developers and site owners who care about protection and compliance.<\/p>\n\n WordSentinel securely connects to a small number of external APIs to perform license validation and site analysis:<\/p>\n\n Mozilla Observatory API<\/strong> \u2013 Used to analyze your website\u2019s HTTP headers and generate a public security grade. Nexsol License Validation API<\/strong> \u2013 Used to verify premium licenses and maintain secure feature access. Nexsol Public Key API<\/strong> \u2013 Used to securely retrieve the public keys required for validating license signatures. All requests are transmitted securely via HTTPS. This plugin is licensed under the GPLv2 or later. For documentation, updates, and premium features, visit https:\/\/nexsol-tech.ch\/wordsentinel<\/p>\n\n\n Install WordSentinel<\/strong><\/p>\n\n Run Your First Security Scan<\/strong><\/p>\n\n Configure Your Security Headers<\/strong><\/p>\n\n Review Your Site<\/strong><\/p>\n\n (Optional) Activate Premium Features<\/strong><\/p>\n\n Once activated, open the Advanced CSP<\/strong> tab to fine-tune how your website handles external resources and inline code. Script Sources ( Style Sources ( Image Sources ( Font Sources ( Frame Sources ( Connect Sources ( Media Sources ( Default Sources ( \ud83d\udca1 When a Resource is Blocked<\/strong><\/p>\n\n If your browser\u2019s console shows an error such as:<\/p>\n\n That means WordSentinel is actively protecting your website<\/strong> \u2014 the CSP is doing its job. WordSentinel\u2019s premium CSP module is designed to make advanced header configuration safe and understandable, even for non-developers \u2014 giving you both control and peace of mind.<\/p>\n\n\n HTTP security headers tell browsers how to handle your site\u2019s resources safely, helping to prevent data leaks and malicious injections.<\/p><\/dd>\n No. Everything is managed through an intuitive interface with clear explanations and automatic validation.<\/p><\/dd>\n
\nIt provides clear dashboards, actionable insights, and real-time grading so you can reinforce your headers with confidence \u2014 no deep technical knowledge required.<\/p>\n\nWhat WordSentinel Does<\/h4>\n\n
\n- Clickjacking attacks
\n- Content injection and mixed content issues
\n- Insecure resource loading (scripts, iframes, styles)<\/p>\n\nKey Features<\/h4>\n\n
\n
\nEasily configure headers such as:<\/p>\n\n\n
\nInstantly scan your site via Mozilla Observatory and get a visual security grade.
\nThe plugin automatically handles rate limits with built-in cooldown protection.<\/p><\/li>\n
\nCreate, test, and refine your CSP rules dynamically.
\nWordSentinel now supports automatic hash generation for inline scripts and styles<\/strong>, improving both flexibility and security.<\/p><\/li>\n
\nThe free version covers essential headers and analysis.
\nPremium users unlock advanced CSP tools, automatic reports, and custom integrations.
\nLicenses are securely validated through Nexsol\u2019s API and cached locally for 24 hours.<\/p><\/li>\n
\nAutomatically detects if you are running on localhost and disables API calls for safe testing.<\/p><\/li>\n
\nWordSentinel is lightweight, privacy-respecting, and runs entirely within WordPress.
\nNo telemetry, analytics, or tracking are ever collected.<\/p><\/li>\n
\nTranslated into six languages with an adaptive design inspired by Mozilla\u2019s clean security aesthetic.<\/p><\/li>\n<\/ul>\n\nWhy Choose WordSentinel?<\/h4>\n\n
\n
External Services and API Usage<\/h3>\n\n
\n
\nData sent: only your site\u2019s public URL.
\nService: https:\/\/observatory.mozilla.org\/api\/<\/p><\/li>\n
\nData sent: license key only.
\nService: https:\/\/api.nexsol-tech.ch\/wordsentinel\/licenses<\/p><\/li>\n
\nData sent: none.
\nService: https:\/\/api.nexsol-tech.ch\/wordsentinel\/certs<\/p><\/li>\n<\/ul>\n\n
\nWordSentinel never sends personal information, usage analytics, or tracking data of any kind.<\/p>\n\nLanguages Supported<\/h3>\n\n
\n
License<\/h3>\n\n
\nSee the GPLv2 License for details: https:\/\/www.gnu.org\/licenses\/gpl-2.0.html<\/p>\n\nSupport<\/h3>\n\n
\n
\n
\/wp-content\/plugins\/wordsentinel\/<\/code>, or install it directly from the WordPress Plugin Directory. <\/li>\n\n
\n
\n
\n
\nEach field corresponds to a specific type of resource that browsers enforce under the CSP standard:<\/p><\/li>\n<\/ol>\n\n\n
script-src<\/code>)<\/strong> \u2013 Defines the trusted locations for JavaScript files.
\n Add domains such as https:\/\/cdnjs.cloudflare.com<\/code> or https:\/\/www.googletagmanager.com<\/code> if your site uses external scripts.
\n WordSentinel automatically hashes inline scripts when hashing is enabled.<\/p><\/li>\nstyle-src<\/code>)<\/strong> \u2013 Controls which URLs can load CSS.
\n Include domains like https:\/\/fonts.googleapis.com<\/code> for Google Fonts, or your CDN if styles are served externally.
\n WordSentinel can also hash inline styles for maximum compatibility and security.<\/p><\/li>\nimg-src<\/code>)<\/strong> \u2013 Specifies where images are allowed to load from.
\n For example, you might whitelist https:\/\/cdn.yourhost.com<\/code> or data:<\/code> if your theme uses base64-encoded images.<\/p><\/li>\nfont-src<\/code>)<\/strong> \u2013 Used for font files such as .woff<\/code> or .woff2<\/code>.
\n Common examples include https:\/\/fonts.gstatic.com<\/code> or your CDN\u2019s domain.<\/p><\/li>\nframe-src<\/code>)<\/strong> \u2013 Controls which external pages can be embedded in <iframe><\/code> elements.
\n For example, to allow YouTube or Vimeo embeds, add https:\/\/www.youtube.com<\/code> and https:\/\/player.vimeo.com<\/code>.<\/p><\/li>\nconnect-src<\/code>)<\/strong> \u2013 Defines which endpoints can be called using APIs like fetch()<\/code> or WebSockets.
\n This is critical for AJAX-heavy websites or third-party integrations.<\/p><\/li>\nmedia-src<\/code>)<\/strong> \u2013 Whitelist locations for video or audio files.
\n If your website uses external streaming or hosted media, list their domains here.<\/p><\/li>\ndefault-src<\/code>)<\/strong> \u2013 Acts as a fallback policy for any type of resource not covered above.
\n When in doubt, set this to 'self'<\/code> to restrict everything to your domain unless explicitly whitelisted elsewhere.<\/p><\/li>\n<\/ul>\n\n\n\nRefused to load the script from 'https:\/\/example.com'\nbecause it violates the Content Security Policy directive: \"script-src 'self'\"\n<\/code><\/pre>\n\n
\n To resolve the issue, simply copy the indicated domain (https:\/\/example.com<\/code>) and add it to the corresponding source list (e.g. \u201cScript Sources\u201d) in the Advanced CSP<\/strong> tab.
\n Save your changes, refresh your site, and the resource will load securely while keeping full CSP protection active.<\/p>\n\n\n\n\n
1. What are HTTP security headers?<\/h3><\/dt>\n
2. Do I need coding skills to use WordSentinel?<\/h3><\/dt>\n