add_help_tab( array( 'id' => 'wp360-hs-help-basics', 'title' => __( 'What does Header Security do?', '360-orbit-header-security' ), 'content' => '

' . esc_html( $basics_help ) . '

', ) ); } /** * Deaktivierungs-Rückfrage (README "Suite-übergreifend"): kein Formular, * nur ein kurzer Hinweis vor dem eigentlichen Deaktivieren in der * Plugin-Liste, was dabei aufhoert und was erhalten bleibt. */ public static function enqueue_deactivation_notice_script( $hook ) { if ( 'plugins.php' !== $hook || ! defined( 'WP360_HS_FILE' ) ) { return; } $basename = plugin_basename( WP360_HS_FILE ); $message = __( 'Deactivate Header Security? All configured security headers (HSTS, X-Frame-Options, CSP and more) stop being sent immediately. Your header configuration and the list of external services stay saved and come back if you reactivate the plugin.', '360-orbit-header-security' ); // Kein eigenes Script-Tag im Markup (WordPress.org-Richtlinie): ein Handle // ohne Datei, an das der Code per wp_add_inline_script() haengt. wp_register_script( 'wp360-hs-deactivate', false, array(), WP360_HS_VERSION, true ); wp_enqueue_script( 'wp360-hs-deactivate' ); wp_add_inline_script( 'wp360-hs-deactivate', sprintf( '( function () { var row = document.querySelector( %s ); var link = row ? row.querySelector( \'a[href*="action=deactivate"]\' ) : null; if ( ! link ) { return; } link.addEventListener( \'click\', function ( event ) { if ( ! window.confirm( %s ) ) { event.preventDefault(); } } ); } )();', wp_json_encode( 'tr[data-plugin="' . $basename . '"]' ), wp_json_encode( $message ) ) ); } /** * Gesundheitscheck (README "Suite-übergreifend"): traegt zur * gemeinsamen "360 WP Orbit"-Uebersicht bei -- rein lesend, nichts * wird hier ausgeloest. Bewusst am gemeinsamen, nicht praefigierten * Filter 'wp360_orbit_health' registriert (siehe class-orbit-menu.php). */ public static function health_lines( array $lines, $slug ) { if ( '360-orbit-header-security' !== $slug ) { return $lines; } return $lines; } private static function current_tab() { // Scan/Externe-Dienste (CSP-Zulieferer), Export/Import und Lizenz sind // PRO -- im FREE-Paket gibt es dafuer keine Tabs, auch bei direktem // ?tab=-Aufruf. FREE zeigt stattdessen einen einzigen Pro-Tab. $valid = array( 'status', 'settings', 'pro' ); if ( isset( $_GET['tab'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended $tab = sanitize_key( wp_unslash( $_GET['tab'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended if ( in_array( $tab, $valid, true ) ) { return $tab; } } return 'status'; } private static function current_context() { // Getrennte Backend-Konfiguration ist ein PRO-Feature -- FREE laeuft // immer im Frontend-Kontext, auch bei direktem ?context=admin-Aufruf. return 'frontend'; } public static function enqueue_assets( $hook ) { if ( self::$tools_hook !== $hook ) { return; } wp_enqueue_style( 'wp360-hs-admin', WP360_HS_URL . 'assets/admin.css', array(), WP360_HS_VERSION ); wp_enqueue_script( 'wp360-hs-admin', WP360_HS_URL . 'assets/admin.js', array( 'jquery' ), WP360_HS_VERSION, true ); wp_localize_script( 'wp360-hs-admin', 'wp360HeaderSecurity', array( 'ajaxUrl' => admin_url( 'admin-ajax.php' ), 'nonce' => wp_create_nonce( 'wp360_hs_nonce' ), 'strings' => array( 'quickstartError' => __( 'Error while applying quickstart.', '360-orbit-header-security' ), 'saved' => __( 'Saved.', '360-orbit-header-security' ), 'saveError' => __( 'Error while saving.', '360-orbit-header-security' ), 'hstsChecking' => __( 'Checking …', '360-orbit-header-security' ), 'hstsCheckError' => __( 'Error while checking.', '360-orbit-header-security' ), 'testing' => __( 'Testing …', '360-orbit-header-security' ), 'testError' => __( 'Error while testing.', '360-orbit-header-security' ), 'restoring' => __( 'Restoring …', '360-orbit-header-security' ), 'rolledBack' => __( 'Rolled back automatically.', '360-orbit-header-security' ), ), ) ); } private static function render_tabs( $current_tab ) { $tabs = array( 'status' => __( 'Status & Quickstart', '360-orbit-header-security' ) ); $tabs['settings'] = __( 'Settings', '360-orbit-header-security' ); // Ein einziger Pro-Tab statt gesperrter Attrappen-Tabs (WordPress.org- // Richtlinie 11: Upgrade-Hinweise sparsam und nur auf der eigenen // Einstellungsseite). Der PRO-Build zeigt stattdessen seine echten Tabs. $show_pro_tab = true; if ( $show_pro_tab ) { $tabs['pro'] = __( 'Header Security Pro', '360-orbit-header-security' ); } ?>

$label ) { ?>

Content-Security-Policy

' . esc_html__( 'Active', '360-orbit-header-security' ) . '' : '' . esc_html__( 'Off', '360-orbit-header-security' ) . ''; echo '' . esc_html( $label ) . '' . wp_kses( $status, array( 'span' => array( 'class' => true ) ) ) . '' . ( $active && $value_renderer ? esc_html( $value_renderer( $header_config ) ) : '' ) . ''; } private static function render_status_table( array $config, $context = 'frontend' ) { ?> 'max-age=' . $c['max_age'] . ( $c['include_subdomains'] ? '; includeSubDomains' : '' ) . ( $c['preload'] ? '; preload' : '' ) ); self::status_row( 'X-Frame-Options', $config['x_frame_options'], fn ( $c ) => $c['value'] ); self::status_row( 'CSP frame-ancestors', $config['frame_ancestors'], fn ( $c ) => 'frame-ancestors ' . $c['value'] ); self::status_row( 'X-Content-Type-Options', $config['x_content_type_options'], fn () => 'nosniff' ); self::status_row( 'Referrer-Policy', $config['referrer_policy'], fn ( $c ) => $c['value'] ); self::status_row( 'Permissions-Policy', $config['permissions_policy'], fn ( $c ) => $c['value'] ); self::status_row( 'Cross-Origin-Opener-Policy', $config['coop'], fn ( $c ) => $c['value'] ); self::status_row( 'Cross-Origin-Resource-Policy', $config['corp'], fn ( $c ) => $c['value'] ); if ( 'frontend' === $context ) { self::status_row( __( 'Cookies: Secure + SameSite', '360-orbit-header-security' ), $config['cookie_hardening'], fn ( $c ) => 'SameSite=' . $c['samesite'] ); } ?>

360 Orbit ()

-- das steckt hier im Flex-Branding-Block, die Meldung erschiene also neben der Ueberschrift statt darunter. ?>

' . esc_html__( 'Header Security Pro', '360-orbit-header-security' ) . '' ); ?>

Strict-Transport-Security (HSTS)

>
max-age: > includeSubDomains > preload

X-Frame-Options

Content-Security-Policy: frame-ancestors

X-Content-Type-Options

Referrer-Policy

Permissions-Policy

$description ) : ?> >