features-security.php
Security features
Neutral login error, response headers, fingerprint headers, JSONP, file editor and application passwords. All of them are global: they act on anonymous requests, headers or constants, where no user context exists, so the exempt roles do not apply. Hook names were checked against the WordPress 7.1.3 source.
Tags
Table of Contents
Constants
- DISALLOW_FILE_EDIT : mixed = true
Functions
- jpkcom_harden_trim_register_security_features() : void
- Register the hooks of the active security features.
- jpkcom_harden_trim_neutral_login_errors() : WP_Error
- Replace the user-enumerating login errors by one neutral message.
- jpkcom_harden_trim_filter_login_errors() : mixed
- `wp_login_errors` callback, limited to the login form.
- jpkcom_harden_trim_security_headers() : array<string, string>
- Security response headers to send for the active settings.
- jpkcom_harden_trim_send_security_headers() : void
- `send_headers` callback: send the security headers on the front end.
- jpkcom_harden_trim_remove_fingerprint_headers() : void
- `send_headers` callback: drop `X-Powered-By` on the front end.
- jpkcom_harden_trim_filter_app_passwords_for_user() : bool
- `wp_is_application_passwords_available_for_user` callback for the `roles` mode.
Constants
DISALLOW_FILE_EDIT
public
mixed
DISALLOW_FILE_EDIT
= true
Functions
jpkcom_harden_trim_register_security_features()
Register the hooks of the active security features.
jpkcom_harden_trim_register_security_features(array<string, mixed> $settings) : void
Parameters
- $settings : array<string, mixed>
-
Effective settings.
Tags
jpkcom_harden_trim_neutral_login_errors()
Replace the user-enumerating login errors by one neutral message.
jpkcom_harden_trim_neutral_login_errors(WP_Error $errors) : WP_Error
Only invalid_username, invalid_email and incorrect_password are
replaced; codes from other plugins (two-factor, captcha, lockout) stay.
Parameters
- $errors : WP_Error
-
Login errors.
Tags
Return values
WP_Error —The same object with the mapped codes replaced.
jpkcom_harden_trim_filter_login_errors()
`wp_login_errors` callback, limited to the login form.
jpkcom_harden_trim_filter_login_errors(mixed $errors[, mixed $redirect_to = '' ]) : mixed
wp-login.php applies the filter in two places: the checkemail case
and the login case (case 'login': default:, so every unknown action
is a login request too). The lost-password flow does not use it, and
checkemail never carries credential errors, so only that action is
skipped; gating on login alone would let action=foo bypass the
neutral message.
Parameters
- $errors : mixed
-
Login errors.
- $redirect_to : mixed = ''
-
Redirect destination (unused).
Tags
Return values
mixed —The errors, rewritten unless the action is checkemail.
jpkcom_harden_trim_security_headers()
Security response headers to send for the active settings.
jpkcom_harden_trim_security_headers(array<string, mixed> $settings, array<int, string> $already_sent, bool $is_ssl, bool $is_embed) : array<string, string>
A header whose name is already in $already_sent (set in PHP by core or
another plugin) is never returned, so the plugin cannot override it.
headers_list() only knows headers set in PHP: one added by the web
server (nginx add_header, Apache mod_headers) or a CDN is invisible
here and would be sent twice.
Parameters
- $settings : array<string, mixed>
-
Effective settings.
- $already_sent : array<int, string>
-
Raw
headers_list()lines. - $is_ssl : bool
-
Whether the request is HTTPS.
- $is_embed : bool
-
Whether the response is an embed.
Tags
Return values
array<string, string> —Header name => value.
jpkcom_harden_trim_send_security_headers()
`send_headers` callback: send the security headers on the front end.
jpkcom_harden_trim_send_security_headers() : void
Tags
jpkcom_harden_trim_remove_fingerprint_headers()
`send_headers` callback: drop `X-Powered-By` on the front end.
jpkcom_harden_trim_remove_fingerprint_headers() : void
Tags
jpkcom_harden_trim_filter_app_passwords_for_user()
`wp_is_application_passwords_available_for_user` callback for the `roles` mode.
jpkcom_harden_trim_filter_app_passwords_for_user(mixed $available[, mixed $user = null ]) : bool
Registered from the booting site's settings, decided with the current
site's: after switch_to_blog() a site whose mode is unchanged keeps
core's answer and a disabled site denies.
Parameters
- $available : mixed
-
Availability so far.
- $user : mixed = null
-
The user checked.
Tags
Return values
bool —True only when already available and the user holds an allowed role.