Remove: prefetch-src from the Content-Security-Policy
no longer supported: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/prefetch-src
3.6.46
Fix: Implementation Page
now accurately reflects the confguration set
3.6.44
Verify: Up to 6.3 Compliant
Fix: PHP 8.2 deprecation notices in field Framework
3.6.33
Test: Up to 6.2 compliant
3.6.22
Add: setting for allowing an access control origin
This should help out with CORS issues, especially from google
3.6.11
Fix: PHP 8 warning messages
Warning: Undefined array key “Permissions-Policy”
Fix: PHP 8 fatal error on special circumstance
KCP_CSPGEN_Headers::kp_get_generated_csp(): Return value must be of type array, string returned
3.6.02
Test: Up to 6.1.2 compliant
Fixed: Directory traversal in plugin
Fixed: Added check/uncheck all option for checkbox field.
Updated: Google Web Fonts array added new fonts.
Updated: JS libraries (codemirror, leaflet, etc).
Improved: Some JS and CSS coding.
3.5.17
Test: Up to 6.1.1 compliant
Remove: Server identifiers removers.
Rework: Broke out the front-end and admin headers to separate methods
Fix: Check for duplicate headers, or already set headers
3.4.28
Fix: Typo in versioning
3.4.27
Test: Up to 6.0.2 compliant
Tech: force PHP 7.4 minimum
Remove: Upgrader hook
this is no longer needed
Remove: X-XSS-Protection Header
was depracated in version 2.2.13. Only compatible browsers as of 7/14/2022 are Edge and and Safari
Use CSP to mitigate XSS
3.3.01
Test: Up to 6.0 compliant
Test: Up to PHP 8.1 Compliant
New: Plugin Icon =)
Updated: Settings Field Framework
Added: Number field “min”, “max”, “step” options.
Updated: Google Web Fonts array added new fonts.
Updated: JS libraries (codemirror, leaflet, etc).
Improved: Group field “custom title and prefix” option (samples added).
Improved: Some JS and CSS coding.
3.2.37
Fix: Eval and Inline for empty directives
3.2.34
Fix: Forgot a debugging var_dump… SMH
3.2.33
Fix: Include blank directives:
Even if the directives are blank for the CSP, they should still be included with the ‘self’ flag
Test: Up to 5.9.2 compliant
Fix: CLI performance.
Was timing out, then skipping some directives on larger sites.
3.1.02
Fix: Default WP CSP headers not being set
Fix: Implementation now includes Default WP
Feature: Implement debug check to queue unminified style and scripts
Fix: Implementation from the CLI pulls
3.0.77
Update: Settings framework
3.0.68
Fix: OR to ||
forgot about it in the main plugin file
Update: translatable resources
New: /languages/security-header-generator.pot
3.0.10
Fix: Array issue
Fix: Strict typing issue
3.0.09
Feature: Implement post update hook to try to properly migrate existing settings to the new format
Update: Change exportable/importable settings names, more legible
While I will do my best to automate this, please note it may not be perfect… I am only human after all 😉
If you export your settings before updating, you can import them again after updating and the below will be
taken care of for you.
Just in case it does not work 100%, please export your settings before updating to this version and
perform a search and replace for the string to remove it:
Search: “kp_cspgen_”
Replace: null|nothing|empty
NOTE: If you do not export your settings I will not guarantee that you will not have to reconfigure the plugin.
Although… I did take a backup 😉 You will need to hop into your database to grab it though, it will be in your
options table, and it is called: wpsh_TEMP_settings. I will have this automatically removed in a future update
Add: Option to remove server advertising.
Add: Expect-CT header
The Expect-CT header lets sites opt in to reporting and/or enforcement of Certificate Transparency requirements,
to prevent the use of misissued certificates for that site from going unnoticed.
