Full Malware Scan (Themes / Plugins / Uploads)

Description: Scans common WordPress directories for suspicious files and malware patterns. How it works: AegisShield enumerates files in selected directories and evaluates them with heuristic checks, producing a report of suspects. How to access / configure: WP Admin → AegisShield → Malware Scan. Select directories (themes, plugins, uploads). Run Full Scan and review findings. Recommended setting: Run weekly on production sites; run immediately after any compromise indicators.

Description: Limit security header profiles to specific URL paths (Pro). How it works: profiles_custom_paths lets you apply different header rules to different sections of your site. How to access / configure: WP Admin → AegisShield → Security Headers → Profiles (Pro). Add path rules (e.g., /wp-admin/*, /checkout/*). Save and test. Recommended setting: Use stricter headers on admin and sensitive pages; keep relaxed for legacy pages if needed.

Security Header Profiles

Description: Apply pre-built security profiles such as Relaxed / Balanced / Strict (Pro). How it works: Profiles set multiple header values together, making it easier to adopt best-practice defaults. How to access / configure: WP Admin → AegisShield → Security Headers → Profiles (Pro). Select a profile. Save and test key site pages. Recommended setting: Start with Balanced; move to Strict after CSP violations are addressed.

Description: Add custom directives to CSP when you need advanced control (Pro). How it works: builder_extra_directives and builder_extra_mode append additional CSP rules beyond the guided fields. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Enter extra directives. Save and test. Recommended setting: Only use if you understand CSP; validate directives to avoid breaking the site.

Description: Restricts which sites can embed your site in an iframe (anti-clickjacking) (Pro). How it works: builder_frame_ancestors sets the CSP frame-ancestors directive; pairs well with X-Frame-Options. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Set frame ancestors to 'none' or 'self'. Save changes. Recommended setting: Use 'none' for most sites; 'self' if you embed your own pages internally.

Description: Controls which endpoints your site can connect to (AJAX, APIs) via CSP connect-src (Pro). How it works: builder_connect_src and builder_connect_mode define allowed origins for fetch/XHR/WebSocket connections. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Connect settings. Add API domains and Save Changes. Recommended setting: Only allow your own domain and required external APIs (payments, analytics, etc.).

Description: Defines allowed font sources for CSP (Pro). How it works: builder_font_src and builder_font_mode control allowed origins for fonts. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Font settings. Add required domains and Save Changes. Recommended setting: If using Google Fonts, allow only the needed domains; otherwise keep to 'self'.

Description: Defines allowed image sources for CSP (Pro). How it works: builder_img_src and builder_img_mode define allowed origins for images; helps prevent data exfil via image beacons. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Image settings. Add required domains and Save Changes. Recommended setting: Allow 'self' and your media/CDN domains; avoid allowing all.

Description: Defines allowed style sources for CSP (Pro). How it works: builder_style_src and builder_style_mode define allowed origins for stylesheets. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Style settings. Add required domains and Save Changes. Recommended setting: Keep to 'self' + required CDN domains only.

Allow Inline CSS in CSP

Description: Allows or blocks inline CSS (unsafe-inline) in CSP (Pro). How it works: builder_allow_inline_css controls whether inline styles are permitted; disabling reduces injection risk but may require theme adjustments. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Toggle “Allow inline CSS”. Save and test layout. Recommended setting: Prefer OFF if possible; otherwise keep ON but restrict other directives tightly.

Archives: FAQs | Aegisify - WordPress Tools, Security…

Categories: AegisShield
Full Malware Scan (Themes / Plugins / Uploads)
read more
Categories: AegisShield
Custom Profile Paths
read more
Categories: AegisShield
Security Header Profiles
read more
Categories: AegisShield
Extra CSP Directives
read more
Categories: AegisShield
Frame Ancestors
read more
Categories: AegisShield
CSP Connect Sources
read more
Categories: AegisShield
CSP Font Sources
read more
Categories: AegisShield
CSP Image Sources
read more
Categories: AegisShield
CSP Style Sources
read more
Categories: AegisShield
Allow Inline CSS in CSP
read more

What’s New At Aegisify