=== Pantry Headers ===
Contributors: pluginpantry
Tags: headers
Requires at least: 6.4
Tested up to: 7.1
Stable tag: 1.0.0
Requires PHP: 8.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Security headers with a tester.

== Description ==

The response headers every site should send, set from one screen with sensible defaults and a button that fetches your own home page and shows what actually arrived. Strict transport security, frame options, content type sniffing, referrer policy and permissions policy.

Pantry Headers is built to the Pantry Standard, a public document that fixes what every Plugin Pantry plugin may and may not do: https://thepluginpantry.com/standard

= What it does =

* Strict-Transport-Security with max-age, include subdomains and preload, offered only when the site runs on https
* X-Frame-Options or a frame-ancestors directive, your choice
* X-Content-Type-Options nosniff
* Referrer-Policy from the standard list
* Permissions-Policy for camera, microphone, geolocation, payment and a few others, each off by default
* Headers sent on front-end, admin and REST responses, and skipped when the server already sends the same header
* A test button that requests your home page from the server and lists the security headers that came back

= What it does not do =

* No full Content-Security-Policy builder in the free plugin
* No .htaccess or server configuration writing
* No removal or rewriting of headers other plugins send
* No HSTS preload list submission

== Pro add-on ==

A separate Pantry Pro add-on is planned. It will extend this plugin with:

* Content-Security-Policy builder with report collection and a report viewer
* Per-path header overrides

Nothing in this free plugin is locked or limited. It is complete for its scope.

== Installation ==

1. Upload the plugin folder to /wp-content/plugins/ or install it from the Plugins screen.
2. Activate it.
3. Open Plugin Pantry > Headers and set it up.

== Frequently Asked Questions ==

= Does the free plugin expire or nag? =

No. It keeps working forever and never shows a sales notice.

= Does it send any data anywhere? =

Only what the feature itself requires, and that is listed on the plugin page.

= Where do I report a bug? =

https://thepluginpantry.com/support

== Changelog ==

= 1.0.0 (2026-09-12) =

* First release.
* Strict-Transport-Security with max age, include subdomains and preload,
* Clickjacking protection: X-Frame-Options (SAMEORIGIN or DENY) or a
* X-Content-Type-Options: nosniff, on by default.
* Referrer-Policy, chosen from the standard list of values.
* Permissions-Policy switches for camera, microphone, geolocation, payment,
* Headers are sent on the front end, in wp-admin and on REST responses, and
* A "Test now" button that fetches the site's own home page and lists the
