Sentinel Headers

== Description ==

Every security-headers plugin will happily set a Content Security Policy that breaks your checkout. Sentinel Headers starts in report-only mode, collects what would have been blocked for a week, and shows you that list before you enforce anything.

It sets CSP, Referrer-Policy, Permissions-Policy, X-Content-Type-Options and HSTS. It does not set X-XSS-Protection, because that header has been harmful for years and plugins that still set it are copying each other.

Reports are stored locally in a table you can drop. Nothing is sent to a reporting endpoint you do not control.

== Screenshots ==

Numbered the way they ship in /assets/. Click any one to see it full width.

01

02

03

04

05

06

== Installation ==

• Install and activate the plugin. Report-only mode is on by default.
• Leave it for a week under real traffic.
• Read the report under Tools → Headers, then enforce.

Enforcing on day one is how you find out your payment provider loads a script from a domain nobody documented.

== Frequently asked questions ==

Will this break my site?

Not in report-only mode, which is where it starts. Enforcement is a decision you make after reading the report.

Does it work behind a CDN?

Yes, as long as the CDN forwards response headers. Most do; the readme lists the ones that need configuration.

Can I set headers per page?

Yes, through a filter. Doing it in the UI would produce a policy nobody can audit.

== Changelog ==