WPIntell

Source evidence

blob:

Security Header Generator · support · 2023-08-11T04:54:00+00:00

Security Header Generator plugin evidence original source source API
mixedsentiment
highseverity
0.88relevance
3replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

6 / 32 rows with source links

18.8% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

26 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
Knut Sparhell resolved
It seems the new emoji detector in WP 6.3 creates a blob as worker-src. Maybe add “worker-src blob:” to “Include WordPress defaults”? Also: If child-src is deprecated, and fallback is script-src, could it be removed? child-src is not deprecated as of yet, and still has full browser support: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src I do see some articles showing it was, however, it has since been un-deprecated as of December 2018 Interestingly enough though, W3C has marked frame-src as deprecated… as of July 31st: https://www.w3.org/TR/CSP3/#changes-from-level-2 However, it is still supported in all the major browsers, and is yet listed as such here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src so… it will likely not go anywhere anytime soon… Agreed, I can certainly add that to wordpress defaults. Next version 🙂 Just wanted to give you a heads up @knutsp I will likely be pushing this update over the next couple of days… I had too many items in that default, so I have had to remove some from it (items like wpengine, fontawesome, etc… are all now non-default), but I have verified against the base Twenty Twenty theme-set (2020 – 2023) all is working fine for it even in customizer and the new full theme editor. releasing today

Comments

3 shown
Kevin Pirnie 2023-08-12T14:22:00+00:00

child-src is not deprecated as of yet, and still has full browser support: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src I do see some articles showing it was, however, it has since been un-deprecated as of December 2018 Interestingly enough though, W3C has marked frame-src as deprecated… as of July 31st: https://www.w3.org/TR/CSP3/#changes-from-level-2 However, it is still supported in all the major browsers, and is yet listed as such here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src so… it will likely not go anywhere anytime soon… Agreed, I can certainly add that to wordpress defaults. Next version 🙂

Kevin Pirnie 2023-08-16T13:03:00+00:00

Just wanted to give you a heads up @knutsp I will likely be pushing this update over the next couple of days… I had too many items in that default, so I have had to remove some from it (items like wpengine, fontawesome, etc… are all now non-default), but I have verified against the base Twenty Twenty theme-set (2020 – 2023) all is working fine for it even in customizer and the new full theme editor.

Kevin Pirnie 2023-08-22T12:55:00+00:00

releasing today