Title: Nubivio Security Headers, security.txt & NIS2 Compliance for Healthcare Author: nubivio Published: 1. Juli 2026 Last modified: 1. September 2026 --- Plugins suchen ![](https://ps.w.org/nubivio-healthcare-security-hardening/assets/banner-772x250. png?rev=3592426) ![](https://ps.w.org/nubivio-healthcare-security-hardening/assets/icon-256x256.png? rev=3592426) # Nubivio Security Headers, security.txt & NIS2 Compliance for Healthcare Von [nubivio](https://profiles.wordpress.org/nubivio/) [Herunterladen](https://downloads.wordpress.org/plugin/nubivio-healthcare-security-hardening.2.5.0.zip) * [Details](https://de.wordpress.org/plugins/nubivio-healthcare-security-hardening/#description) * [Rezensionen](https://de.wordpress.org/plugins/nubivio-healthcare-security-hardening/#reviews) * [Installation](https://de.wordpress.org/plugins/nubivio-healthcare-security-hardening/#installation) * [Entwicklung](https://de.wordpress.org/plugins/nubivio-healthcare-security-hardening/#developers) [Support](https://wordpress.org/support/plugin/nubivio-healthcare-security-hardening/) ## Beschreibung Set the security headers that matter, publish a self-renewing **security.txt** ( RFC 9116), and check your site against **NIS2**, the EU Cyber Resilience Act (CRA), GDPR and NEN 7510, all from one settings page. Built for general practitioners, psychologists and other healthcare professionals who need a defensible security baseline without a consultant. The defaults are safe to ship on a live site, and the plugin is built to move your score on the internet.nl test in the right direction. The compliance features are optional and read-only: they verify and document what you already have, and never change your hardening. **Why healthcare sites use this** * One click to a strong header set and a valid security.txt, the two things the internet.nl test and most security reviews check first. * An optional Compliance tab that turns those headers and your security.txt into evidence, mapped to NIS2 Art. 21, CRA Art. 14 and GDPR clauses. * A compliance score with a plain-language breakdown, so you know where you stand and what to fix next. * Available in English and Dutch. It covers four areas: **Security headers** * Strict-Transport-Security (HSTS) with configurable max-age, includeSubDomains and preload * Content-Security-Policy with an internet.nl compliant baseline and a Report-Only test mode * Referrer-Policy with the internet.nl rating shown per value * X-Content-Type-Options (nosniff) * X-Frame-Options * Permissions-Policy * Active removal of the deprecated X-XSS-Protection and Expect-CT headers * Optional COOP, COEP credentialless, CORP and an extended Permissions-Policy **security.txt (RFC 9116)** * Writes /.well-known/security.txt and serves it dynamically when the docroot is read-only * Refreshes the Expires field automatically so it never lapses and stays under one year * Fields for Contact, Encryption, Policy, Acknowledgments, Hiring (careers), CSAF, Preferred-Languages and Canonical * Paste your PGP public key and the plugin hosts it at /.well-known/openpgp-key. txt and links it as Encryption automatically * A free-text message to researchers and an optional signature line * CRLF line endings and a valid Canonical URL, exactly as the internet.nl test expects **Compliance scanner (optional, new in 2.2.0)** * A Compliance tab with a single compliance score and a red / amber / green band * CRA plugin readiness: checks each active plugin against the WordPress.org directory for update currency, compatibility and abandonment * GDPR checks: detects third-party scripts, forms and consent tooling, and cross- references your Content-Security-Policy * NIS2 Art. 21 signals: encryption in transit, MFA, backups, WAF, activity logging and auto-updates * Site health checks: security.txt validity, live header verification, WordPress and PHP currency, TLS, debug mode, XML-RPC and REST user exposure * WordPress core integrity: verifies your core files against the official WordPress. org checksums and reports modified or missing files (new in 2.3.0) * Access and integrity: an approved administrator baseline, recently created admins, roles and users with unexpected administrator capabilities, an application password audit, a must-use plugin audit and a siteurl sanity check (new in 2.3.0) * Live verification that your configured security headers are actually being sent, not just set * Security headers and security.txt shown as compliance evidence, mapped to the relevant NIS2, CRA and GDPR clauses * HSTS preload readiness, DNS health (SPF, DMARC, DKIM, CAA, MTA-STS, DNSSEC and AAAA), CSP report-only inventory and violation viewer, SRI detector, and TLS certificate overview (new in 2.4.0) * One-click documents generated from your own settings: a Vulnerability Disclosure Policy, a CycloneDX SBOM, an EU and NEN 7510 conformity declaration, and a printable compliance report **Gravity Forms (optional)** * Block submissions from one or more email domains, with a custom error message * The section only appears when Gravity Forms is active This plugin configures headers and a security.txt and helps you document your posture. It is one building block toward NIS2, CRA, GDPR and NEN 7510, not a full compliance programme, and the generated documents are self-assessment starting points, not certifications. It cannot change DNS or server level items such as IPv6, the CAA record, the TLS key-exchange hash or DANE. Those are handled at your host or DNS provider. ### External Services The core hardening features (security headers and security.txt) make no external requests. The optional Compliance tab, introduced in 2.2.0, uses the following external services only when you run a scan (manually or via the optional scheduled scan). Nothing here runs on normal front-end page loads. **WordPress.org Plugins API** When a compliance scan runs, the plugin looks up each active plugin in the WordPress. org Plugins directory to check update currency and compatibility. * What is sent: the public plugin slug only (for example, „akismet“). No personal data, no site data. * When: only during a manual or scheduled compliance scan. * Endpoint: https://api.wordpress.org/plugins/info/1.0/{slug}.json and https:// api.wordpress.org/core/version-check/1.7/ * Caching: results are cached in a transient for 12 hours. * This is a first-party WordPress.org endpoint. Terms: https://wordpress.org/about/ privacy/ **WordPress.org Checksums API** When a compliance scan runs, the plugin retrieves the published MD5 checksums for your WordPress version so it can verify that your core files have not been altered. * What is sent: your WordPress version and site locale (for example, „6.8“ and „ nl_NL“). No personal data, no site data, no file contents. Files are hashed locally and only the hashes are compared. * When: only during a manual or scheduled compliance scan. * Endpoint: https://api.wordpress.org/core/checksums/1.0/ * Caching: the checksum list is cached in a transient for 12 hours (1 hour if the request fails). * This is a first-party WordPress.org endpoint. Terms: https://wordpress.org/about/ privacy/ **Loopback self-request (header and REST probe)** When a compliance scan runs, the plugin makes a request to its own home URL to verify that the configured security headers are actually being sent and to check whether the REST users endpoint exposes user data. * What is sent: a normal HTTP GET to the site’s own home URL. No third-party service is contacted. * When: only during a manual or scheduled compliance scan, or admin/cron context. Never on normal front-end page loads. * Timeout: short (8 seconds). Result cached in a transient for 10 minutes. * If the request fails (some hardened hosts block self-requests), the plugin falls back to showing configured values and reports that live verification was unavailable. **Cloudflare DNS over HTTPS (optional)** When you opt in to DNSSEC validation through Cloudflare DoH, the plugin sends only the site hostname to Cloudflare’s DNS resolver. * What is sent: the site hostname. No personal data or site content. * When: only during a manual or scheduled compliance scan, and only when the optional DNSSEC DoH setting is enabled. * Endpoint: https://cloudflare-dns.com/dns-query * Caching: response is cached in a transient for 6 hours. **Local CSP report endpoint** When CSP report-only is enabled, browsers may POST reports to the local endpoint/ wp-json/nubivio-hsh/v1/csp-report. This is not an outbound or third-party service call. Reports are rate-limited and stored as a rolling local option buffer. ## Screenshots [⌊The Nubivio Security settings page: header status card with the live security. txt state, the security headers section with per-header toggles, and the RFC 9116 security.txt fields.⌉⌊The Nubivio Security settings page: header status card with the live security.txt state, the security headers section with per-header toggles, and the RFC 9116 security.txt fields.⌉[ The Nubivio Security settings page: header status card with the live security.txt state, the security headers section with per-header toggles, and the RFC 9116 security. txt fields. [⌊The Compliance tab: compliance score, CRA, GDPR and NIS2 findings, site health checks and the security headers and security.txt evidence panels.⌉⌊The Compliance tab: compliance score, CRA, GDPR and NIS2 findings, site health checks and the security headers and security.txt evidence panels.⌉[ The Compliance tab: compliance score, CRA, GDPR and NIS2 findings, site health checks and the security headers and security.txt evidence panels. [⌊The compliance score at a glance, with the red / amber / green band and the high, medium and low finding counts.⌉⌊The compliance score at a glance, with the red / amber / green band and the high, medium and low finding counts.⌉[ The compliance score at a glance, with the red / amber / green band and the high, medium and low finding counts. ## Installation 1. Upload the plugin folder to /wp-content/plugins/, or install the ZIP via Plugins, Add New, Upload Plugin. 2. Activate the plugin. 3. Open Settings, Nubivio Security. 4. Set a Contact value under security.txt. 5. To pass the internet.nl Content-Security-Policy check, enable CSP, test in Report- Only, add the domains your site needs, then turn Report-Only off to enforce. ## FAQ ### Will activating the plugin break my site? No. HSTS, nosniff, X-Frame-Options, Referrer-Policy and Permissions-Policy are safe defaults. Content-Security-Policy is off by default because a strict policy needs tuning per site. ### How do I get a fully green internet.nl result? Enable and enforce a Content-Security-Policy that fits your site, set Referrer-Policy to no-referrer or same-origin, and set a Contact for security.txt. IPv6, CAA, the TLS hash and DANE are out of scope and must be fixed at your host or DNS. ### Can I publish a PGP key? Yes. Paste your ASCII-armored public key in the security.txt section. The plugin hosts it at /.well-known/openpgp-key.txt and references it from security.txt as the Encryption field automatically. ### Does this make me NIS2, CRA, GDPR or NEN 7510 compliant? No single plugin can. It covers the public web hardening part (transport security, browser protections and a vulnerability disclosure contact), verifies it live, and generates starting-point documents such as a Vulnerability Disclosure Policy, an SBOM and a conformity declaration. It is a useful building block and an evidence tool, not a full compliance programme or a certification. ### Is the Compliance tab safe to use? Yes. It is optional and read-only. Scanning only reads your site and public WordPress. org data; it never changes your settings or hardening. If you never open the tab, nothing about your site changes. ### Is Gravity Forms required? No. The header and security.txt features work on any site. The form section only appears when Gravity Forms is active. ## Rezensionen Zu diesem Plugin liegen noch keine Rezensionen vor. ## Mitwirkende und Entwickler „Nubivio Security Headers, security.txt & NIS2 Compliance for Healthcare“ ist Open- Source-Software. Folgende Menschen haben an diesem Plugin mitgewirkt: Mitwirkende * [ nubivio ](https://profiles.wordpress.org/nubivio/) „Nubivio Security Headers, security.txt & NIS2 Compliance for Healthcare“ wurde in 1 Sprache übersetzt. Danke an [die Übersetzer](https://translate.wordpress.org/projects/wp-plugins/nubivio-healthcare-security-hardening/contributors) für ihre Mitwirkung. [Übersetze „Nubivio Security Headers, security.txt & NIS2 Compliance for Healthcare“ in deine Sprache.](https://translate.wordpress.org/projects/wp-plugins/nubivio-healthcare-security-hardening) ### Interessiert an der Entwicklung? [Durchstöbere den Code](https://plugins.trac.wordpress.org/browser/nubivio-healthcare-security-hardening/), sieh dir das [SVN-Repository](https://plugins.svn.wordpress.org/nubivio-healthcare-security-hardening/) an oder abonniere das [Entwicklungsprotokoll](https://plugins.trac.wordpress.org/log/nubivio-healthcare-security-hardening/) per [RSS](https://plugins.trac.wordpress.org/log/nubivio-healthcare-security-hardening/?limit=100&mode=stop_on_copy&format=rss). ## Änderungsprotokoll #### 2.5.0 * Compliance mapping to NEN 7510-2:2024 and ISO 27001:2022 Annex A control level. * Pre-consent cookie and tracker analysis with consent-plugin detection. * SPF policy grading, RFC 7208 lookup-limit counting, DKIM key strength, TLS-RPT, BIMI, no-mail detection. * DNS NS redundancy and SOA freshness checks. * CSP policy effectiveness grading (A-F) on the plugin’s own generated policy. * CSP enforce switch with 14-day inventory preflight and fail-safe fallback to report-only. * security.txt Expires countdown and drift detection. * Reformatted v2.4.0 modules to WordPress Coding Standards (no behavior change). #### 2.4.0 * Additional optional hardening headers: COOP, COEP credentialless, CORP and extended Permissions-Policy * HSTS preload readiness check and Compliance card * DNS health dashboard for SPF, DMARC, DKIM, CAA, MTA-STS, DNSSEC indicator with optional Cloudflare DoH validation, and AAAA * CSP report-only phase 1: inventory scanner, local browser report endpoint, violation viewer and add-to-allowlist action * SRI audit detector for external script and stylesheet candidates, without auto- injection * TLS overview card for certificate expiry, signature algorithm, subject and SANs, plus DANE/TLSA presence #### 2.3.1 * Compatibility: tested on WordPress 7.1. No code changes; all scanners verified against the 7.1 API surface. #### 2.3.0 * CRA precision: plugins that are not in the WordPress.org directory are now classified as commercial, possibly removed or unknown, so premium plugins such as Gravity Forms or ACF Pro no longer show up as high severity findings * New setting to list your own private or commercial plugin slugs and skip them from the „not in directory“ warning * New WordPress core integrity check using the official WordPress.org checksums API, reporting modified and missing core files * New Access and integrity card: administrator baseline with an approve action, so any later change to the administrator list is flagged * Detection of administrator accounts created in the last 30 days * Detection of non-administrator roles and users that hold administrator capabilities * Application password audit across administrator accounts, flagging passwords created since the approved baseline * Must-use plugin audit with an allowlist for the common managed hosts * siteurl sanity check against the current request host * Scan for core files modified well after the last core update * All new checks are read-only and only run during a manual or scheduled compliance scan #### 2.2.2 * Fix: the optional signature line in security.txt now uses a plain ASCII separator, so servers that do not declare UTF-8 no longer render mojibake (e.g. „·“) for the middle dot. #### 2.2.1 * Listing and documentation refresh: clearer description covering the NIS2, CRA and security.txt features, and two new screenshots of the Compliance tab. No code changes. #### 2.2.0 * New Compliance tab: CRA, GDPR and NIS2 scanning plus site health checks * Live verification that configured security headers are actually sent * security.txt and headers now scored and mapped to CRA / NIS2 / GDPR clauses * Compliance score with per-framework breakdown * Generators: Vulnerability Disclosure Policy, CycloneDX SBOM, EU/NEN 7510 conformity declaration * Printable compliance report (browser print to PDF, no added dependencies) * Existing header and security.txt hardening unchanged #### 2.1.2 * Added plugin icon, banner and a settings page screenshot for the WordPress.org listing #### 2.1.1 * All filesystem reads, writes and deletes now go through the WP_Filesystem API and wp_delete_file() #### 2.1.0 * Renamed the plugin to Nubivio Healthcare Security Hardening * Admin CSS and JavaScript are now enqueued instead of printed inline * The security.txt and PGP key files are now located via get_home_path() so they land at the public site root on subdirectory and custom installs * Internal option, cron and nonce keys renamed to the new namespace #### 2.0.0 * Settings page for all options * internet.nl compliant Content-Security-Policy baseline with Report-Only mode * Self-renewing security.txt with CRLF line endings and an expiry kept under one year * Hosted PGP public key, linked from security.txt as Encryption * Extra security.txt fields: Hiring, CSAF, researcher message and an optional signature * Removal of deprecated X-XSS-Protection and Expect-CT headers * Gravity Forms email-domain blocking, shown only when Gravity Forms is active ## Meta * Version **2.5.0** * Zuletzt aktualisiert **vor 2 Monaten** * Aktive Installationen **weniger als 10** * WordPress-Version ** 5.8 oder höher ** * Getestet bis **7.1.3** * PHP-Version ** 7.4 oder höher ** * Sprachen * [Dutch](https://nl.wordpress.org/plugins/nubivio-healthcare-security-hardening/) und [English (US)](https://wordpress.org/plugins/nubivio-healthcare-security-hardening/). * [Übersetze in deine Sprache](https://translate.wordpress.org/projects/wp-plugins/nubivio-healthcare-security-hardening) * Schlagwörter * [headers](https://de.wordpress.org/plugins/tags/headers/)[hsts](https://de.wordpress.org/plugins/tags/hsts/) [nis2](https://de.wordpress.org/plugins/tags/nis2/)[security](https://de.wordpress.org/plugins/tags/security/) [security.txt](https://de.wordpress.org/plugins/tags/security-txt/) * [Erweiterte Ansicht](https://de.wordpress.org/plugins/nubivio-healthcare-security-hardening/advanced/) ## Bewertungen Es wurden noch keine Rezensionen eingereicht. [Deine Rezension](https://wordpress.org/support/plugin/nubivio-healthcare-security-hardening/reviews/#new-post) [Alle Rezensionen anzeigen](https://wordpress.org/support/plugin/nubivio-healthcare-security-hardening/reviews/) ## Mitwirkende * [ nubivio ](https://profiles.wordpress.org/nubivio/) ## Support Möchtest du etwas mitteilen? Brauchst du Unterstützung? [Support-Forum anzeigen](https://wordpress.org/support/plugin/nubivio-healthcare-security-hardening/)