{"id":1052,"date":"2026-10-30T17:05:46","date_gmt":"2026-10-30T16:05:46","guid":{"rendered":"https:\/\/www.cisilino.com\/?p=1052"},"modified":"2026-10-30T17:06:25","modified_gmt":"2026-10-30T16:06:25","slug":"paranoic-hardening-headers-autologout","status":"publish","type":"post","link":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/","title":{"rendered":"Paranoic Hardening: headers and autologout"},"content":{"rendered":"<p>The \u201c\u26a0 Paranoic Hardening\u201d tab of the CSDN plugin brings together the most delicate options: the HTTP security headers, HSTS and the automatic logout of inactive administrators. Here you change the behaviour of the visitor&#8217;s browser, not just the server&#8217;s. That&#8217;s why it&#8217;s all off by default.<\/p>\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp\" alt=\"Diagram of WordPress with the Paranoic Hardening tab of the plugin CSDN highlighted\" width=\"1200\" height=\"630\"\/><\/figure>\n<h2>Where it is<\/h2>\n<p>In the WordPress side menu go to <strong>Settings<\/strong> and choose <strong>Cisilino Site Defense Network<\/strong> (point 1 in the image). Open the \u201c\u26a0 Paranoic Hardening\u201d tab (point 2). Saving requires the <code>manage_options<\/code> permission; on multisite you need <code>manage_network_options<\/code>.<\/p>\n<p>The tab has four sections. At point 3 you&#8217;ll find \u201cParanoic Hardening \u2014 HTTP security headers\u201d. At point 4 there&#8217;s \u201cHTTP Strict Transport Security (HSTS)\u201d. Point 5 is \u201cSecurity header check\u201d. Point 6 is \u201cAutologout of inactive administrators\u201d.<\/p>\n<h2>What it&#8217;s for<\/h2>\n<p>Headers are instructions the site sends the browser along with every page. The plugin sends them through WordPress&#8217;s <code>send_headers<\/code> hook, without touching the <code>.htaccess<\/code> file. So you don&#8217;t risk a 500 error, and they work even without <code>mod_headers<\/code>.<\/p>\n<p>The headers only cover the public site. They are never sent in the admin area. The plugin offers no Content-Security-Policy, and it doesn&#8217;t send X-XSS-Protection.<\/p>\n<h2>How to use Paranoic Hardening<\/h2>\n<h3>HTTP security headers (point 3)<\/h3>\n<ul>\n<li><strong>X-Content-Type-Options<\/strong> sends <code>nosniff<\/code>. The browser stops \u201cguessing\u201d a file&#8217;s type. The risk here is practically nil.<\/li>\n<li><strong>X-Frame-Options<\/strong> sends <code>SAMEORIGIN<\/code>. The site can no longer be embedded in an <code>&lt;iframe&gt;<\/code> on another domain. If a partner site shows your pages, it will stop doing so.<\/li>\n<li><strong>Referrer-Policy<\/strong> sends <code>strict-origin-when-cross-origin<\/code>. Towards other domains only the domain travels, not the path. Third-party statistics tools wanting the full referrer won&#8217;t get it.<\/li>\n<\/ul>\n<p>Tick the boxes you need and press <strong>Save Paranoic Hardening<\/strong>. You&#8217;ll see the notice \u201cParanoic Hardening settings saved and applied.\u201d Boxes you don&#8217;t tick are saved as off.<\/p>\n<h3>HSTS (point 4)<\/h3>\n<p>HSTS tells the browser to always use https with your domain. There are three boxes: \u201cEnable HSTS\u201d, \u201cincludeSubDomains\u201d and \u201cPreload\u201d. The header sent carries <code>max-age=31536000<\/code>, meaning one year. The value is fixed and cannot be changed.<\/p>\n<p>The plugin refuses to activate it if the page wasn&#8217;t opened over https. In that case it saves the rest and shows a red warning: \u201cSettings saved, but HSTS was NOT activated: this request did not arrive over https. Open the panel over https and try again.\u201d If the page is over http, the three boxes are also disabled.<\/p>\n<p>If you turn off \u201cEnable HSTS\u201d, on saving \u201cincludeSubDomains\u201d and \u201cPreload\u201d are reset too. If you turn HSTS back on, you&#8217;ll need to tick them again.<\/p>\n<h3>Security header check (point 5)<\/h3>\n<p>Press <strong>Check now<\/strong>. The plugin makes a real request to the site&#8217;s home page and checks which headers genuinely arrive. The result appears in the box, with the date of the last test.<\/p>\n<ul>\n<li>Green: \u201cAll the expected headers are present in the site&#8217;s real response.\u201d<\/li>\n<li>Red: the active headers that didn&#8217;t arrive. This can be a proxy, a CDN or another plugin removing them. HSTS shows as missing even if the home address is http rather than https, because the plugin only sends it on https requests.<\/li>\n<li>Blue: \u201cNo active header to check: enable at least one option above and save.\u201d<\/li>\n<li>Red with \u201cCheck request failed\u201d: the request didn&#8217;t succeed.<\/li>\n<\/ul>\n<p>The test checks whether a header is present, not its value. It doesn&#8217;t run on its own: you have to press it.<\/p>\n<h3>Autologout of administrators (point 6)<\/h3>\n<p>This section of Paranoic Hardening has its own button, <strong>Save autologout for administrators<\/strong>. Tick \u201cEnable\u201d to log out inactive administrators. Then set the \u201cInactivity timeout (seconds)\u201d. If the browser blocks <code>localStorage<\/code> (in a private window, for instance), the check never fires and you&#8217;re never logged out.<\/p>\n<p>The default value is 900, meaning 15 minutes. The minimum is 60 and the maximum is 86400. If you write a number outside those limits, the plugin moves it to the nearest allowed value. For example, 30 becomes 60. The notice stays green, so reread the number in the field after saving.<\/p>\n<p>Only users with the <code>manage_options<\/code> permission are logged out. Editors and authors aren&#8217;t touched. Inactivity is measured in the browser: mouse, keyboard, scrolling and touch all count. The session closes just as with \u201cLog Out\u201d, and unsaved changes in an open form are lost.<\/p>\n<h2>Recommended order of activation<\/h2>\n<ol>\n<li>Open the panel over https.<\/li>\n<li>Turn on X-Content-Type-Options, save and press \u201cCheck now\u201d.<\/li>\n<li>Turn on Referrer-Policy, save and check.<\/li>\n<li>Check that no site embeds yours, then turn on X-Frame-Options, save and check.<\/li>\n<li>Turn on autologout with a generous timeout, for example 1800. Lower it only after a few days.<\/li>\n<li>Last of all, consider HSTS, without includeSubDomains and without Preload.<\/li>\n<\/ol>\n<p>Turn on one option at a time. If something breaks, you&#8217;ll know straight away which one did it.<\/p>\n<h2>The risk of HSTS, includeSubDomains and Preload<\/h2>\n<p><strong>Warning:<\/strong> HSTS can&#8217;t be undone from the site. If you untick it, the plugin stops sending the header, but browsers that already received it will remember it until it expires. The plugin never sends <code>max-age=0<\/code>, so there&#8217;s no \u201ccancel\u201d. The tab&#8217;s own banner says so too: the effects can stay visible for weeks or months.<\/p>\n<p>With HSTS on, the browser refuses any non-https connection to the domain. If the certificate expires or breaks, the browser no longer even shows the \u201cproceed anyway\u201d screen. The site becomes unreachable from that browser.<\/p>\n<ul>\n<li><strong>includeSubDomains<\/strong> extends the rule to every subdomain. A single subdomain without valid https, even a test one or a future one, becomes unreachable for anyone who has already visited the site. Only turn it on if every subdomain is, and will remain, https.<\/li>\n<li><strong>Preload<\/strong> only adds the <code>preload<\/code> flag to the header. On its own it doesn&#8217;t register the site: submitting it to the browsers&#8217; list is done by hand on hstspreload.org. The list sits inside the browsers, and getting out of it takes weeks. Treat Preload as a final, one-way decision.<\/li>\n<\/ul>\n<p>Always save from the https version of the panel. Disabled boxes aren&#8217;t sent by the browser: saving from an http page switches off HSTS and its sub-options.<\/p>\n<h2>What happens behind the scenes<\/h2>\n<p>The Paranoic Hardening settings are WordPress options, not server rules. Autologout prints a script only on admin pages. The script records the last activity in the browser&#8217;s <code>localStorage<\/code> and checks the timeout every 5 seconds. On expiry it asks <code>admin-ajax.php<\/code> to log you out and takes you to the login page. The save only lands in the Activity log if you actually changed something.<\/p>\n<h2>If something goes wrong<\/h2>\n<ul>\n<li>The box turns red after \u201cCheck now\u201d: a proxy, a CDN or another plugin is stripping the headers. Check their configuration.<\/li>\n<li>A partner site no longer shows your pages: untick X-Frame-Options and save.<\/li>\n<li>You can&#8217;t turn on HSTS: reopen the panel with the https address.<\/li>\n<li>To check the headers by hand, use your browser&#8217;s developer tools or <code>curl -I<\/code> on the site&#8217;s https address.<\/li>\n<\/ul>\n<p>To understand HSTS better, read the page on <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Reference\/Headers\/Strict-Transport-Security\" target=\"_blank\" rel=\"noopener\">Strict-Transport-Security on MDN<\/a>. It explains max-age, includeSubDomains and preload precisely.<\/p>\n<p>Previous: <a href=\"https:\/\/www.cisilino.com\/en\/?p=980\">Test tab: checking that the protections work<\/a>. Next: <a href=\"https:\/\/www.cisilino.com\/en\/?p=982\">User registration: who can create accounts<\/a>. For the general index go to <a href=\"https:\/\/www.cisilino.com\/en\/?p=972\">chapter 1 of the manual<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to use the Paranoic Hardening tab of the plugin CSDN: HTTP headers, HSTS, the check and autologout, with the recommended order and risks.<\/p>\n","protected":false},"author":1,"featured_media":1005,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wpai_generated_summary":"","footnotes":""},"categories":[416],"tags":[164,434,192,188],"class_list":["post-1052","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-csdn-manual","tag-cisilino-site-defense-network-en","tag-csdn-manual","tag-hsts-en","tag-security-headers"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"matteocisilino\"\/>\n\t<meta name=\"google-site-verification\" content=\"_A-1f0dO30IDVHfP9muflI8kHQs-H4YOi8WLUkYzuLE\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Matteo Cisilino - Guide su WordPress, server e sicurezza\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Paranoic Hardening: HTTP headers, HSTS and autologout\" \/>\n\t\t<meta property=\"og:description\" content=\"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-30T16:05:46+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-30T16:06:25+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Paranoic Hardening: HTTP headers, HSTS and autologout\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#blogposting\",\"name\":\"Paranoic Hardening: HTTP headers, HSTS and autologout\",\"headline\":\"Paranoic Hardening: headers and autologout\",\"author\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/author\\\/matteocisilino\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.cisilino.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/manuale-csdn-paranoic-hardening.webp\",\"width\":1200,\"height\":630,\"caption\":\"Schema di WordPress con la scheda Paranoic Hardening del plugin CSDN evidenziata\"},\"datePublished\":\"2026-10-30T17:05:46+01:00\",\"dateModified\":\"2026-10-30T17:06:25+01:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#webpage\"},\"articleSection\":\"CSDN manual, Cisilino Site Defense Network, CSDN manual, HSTS, security headers\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/category\\\/csdn-manual\\\/#listItem\",\"name\":\"CSDN manual\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/category\\\/csdn-manual\\\/#listItem\",\"position\":2,\"name\":\"CSDN manual\",\"item\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/category\\\/csdn-manual\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#listItem\",\"name\":\"Paranoic Hardening: headers and autologout\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#listItem\",\"position\":3,\"name\":\"Paranoic Hardening: headers and autologout\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/category\\\/csdn-manual\\\/#listItem\",\"name\":\"CSDN manual\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/#organization\",\"name\":\"Matteo Cisilino\",\"description\":\"Guide su WordPress, server e sicurezza\",\"url\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.cisilino.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/logo-cisilino-512.png\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#organizationLogo\",\"width\":512,\"height\":512,\"caption\":\"Logo: un cerchio a sinistra che si divide in cerchi pi\\u00f9 piccoli\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/author\\\/matteocisilino\\\/#author\",\"url\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/author\\\/matteocisilino\\\/\",\"name\":\"matteocisilino\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/639872265f0661e8aee8924ba9d756b00ea816f8286fab99a5116c729d49618f?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"matteocisilino\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#webpage\",\"url\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/\",\"name\":\"Paranoic Hardening: HTTP headers, HSTS and autologout\",\"description\":\"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/author\\\/matteocisilino\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/author\\\/matteocisilino\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.cisilino.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/manuale-csdn-paranoic-hardening.webp\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Schema di WordPress con la scheda Paranoic Hardening del plugin CSDN evidenziata\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/2026\\\/10\\\/30\\\/paranoic-hardening-headers-autologout\\\/#mainImage\"},\"datePublished\":\"2026-10-30T17:05:46+01:00\",\"dateModified\":\"2026-10-30T17:06:25+01:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/\",\"name\":\"Matteo Cisilino\",\"description\":\"Guide su WordPress, server e sicurezza\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.cisilino.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Paranoic Hardening: HTTP headers, HSTS and autologout","description":"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.","canonical_url":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"_A-1f0dO30IDVHfP9muflI8kHQs-H4YOi8WLUkYzuLE","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#blogposting","name":"Paranoic Hardening: HTTP headers, HSTS and autologout","headline":"Paranoic Hardening: headers and autologout","author":{"@id":"https:\/\/www.cisilino.com\/en\/author\/matteocisilino\/#author"},"publisher":{"@id":"https:\/\/www.cisilino.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp","width":1200,"height":630,"caption":"Schema di WordPress con la scheda Paranoic Hardening del plugin CSDN evidenziata"},"datePublished":"2026-10-30T17:05:46+01:00","dateModified":"2026-10-30T17:06:25+01:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#webpage"},"isPartOf":{"@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#webpage"},"articleSection":"CSDN manual, Cisilino Site Defense Network, CSDN manual, HSTS, security headers"},{"@type":"BreadcrumbList","@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.cisilino.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/www.cisilino.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.cisilino.com\/en\/category\/csdn-manual\/#listItem","name":"CSDN manual"}},{"@type":"ListItem","@id":"https:\/\/www.cisilino.com\/en\/category\/csdn-manual\/#listItem","position":2,"name":"CSDN manual","item":"https:\/\/www.cisilino.com\/en\/category\/csdn-manual\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#listItem","name":"Paranoic Hardening: headers and autologout"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.cisilino.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#listItem","position":3,"name":"Paranoic Hardening: headers and autologout","previousItem":{"@type":"ListItem","@id":"https:\/\/www.cisilino.com\/en\/category\/csdn-manual\/#listItem","name":"CSDN manual"}}]},{"@type":"Organization","@id":"https:\/\/www.cisilino.com\/en\/#organization","name":"Matteo Cisilino","description":"Guide su WordPress, server e sicurezza","url":"https:\/\/www.cisilino.com\/en\/","logo":{"@type":"ImageObject","url":"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/logo-cisilino-512.png","@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#organizationLogo","width":512,"height":512,"caption":"Logo: un cerchio a sinistra che si divide in cerchi pi\u00f9 piccoli"},"image":{"@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.cisilino.com\/en\/author\/matteocisilino\/#author","url":"https:\/\/www.cisilino.com\/en\/author\/matteocisilino\/","name":"matteocisilino","image":{"@type":"ImageObject","@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/639872265f0661e8aee8924ba9d756b00ea816f8286fab99a5116c729d49618f?s=96&d=mm&r=g","width":96,"height":96,"caption":"matteocisilino"}},{"@type":"WebPage","@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#webpage","url":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/","name":"Paranoic Hardening: HTTP headers, HSTS and autologout","description":"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/www.cisilino.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#breadcrumblist"},"author":{"@id":"https:\/\/www.cisilino.com\/en\/author\/matteocisilino\/#author"},"creator":{"@id":"https:\/\/www.cisilino.com\/en\/author\/matteocisilino\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp","@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#mainImage","width":1200,"height":630,"caption":"Schema di WordPress con la scheda Paranoic Hardening del plugin CSDN evidenziata"},"primaryImageOfPage":{"@id":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/#mainImage"},"datePublished":"2026-10-30T17:05:46+01:00","dateModified":"2026-10-30T17:06:25+01:00"},{"@type":"WebSite","@id":"https:\/\/www.cisilino.com\/en\/#website","url":"https:\/\/www.cisilino.com\/en\/","name":"Matteo Cisilino","description":"Guide su WordPress, server e sicurezza","inLanguage":"en-GB","publisher":{"@id":"https:\/\/www.cisilino.com\/en\/#organization"}}]},"og:locale":"en_GB","og:site_name":"Matteo Cisilino - Guide su WordPress, server e sicurezza","og:type":"article","og:title":"Paranoic Hardening: HTTP headers, HSTS and autologout","og:description":"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.","og:url":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/","og:image":"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp","og:image:secure_url":"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-10-30T16:05:46+00:00","article:modified_time":"2026-10-30T16:06:25+00:00","twitter:card":"summary_large_image","twitter:title":"Paranoic Hardening: HTTP headers, HSTS and autologout","twitter:description":"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.","twitter:image":"https:\/\/www.cisilino.com\/wp-content\/uploads\/2026\/10\/manuale-csdn-paranoic-hardening.webp"},"aioseo_meta_data":{"post_id":"1052","title":"Paranoic Hardening: HTTP headers, HSTS and autologout","description":"Paranoic Hardening in the CSDN plugin: HTTP security headers, HSTS, a header check and autologout for inactive admins. Order and risks explained.","keywords":null,"keyphrases":{"focus":{"keyphrase":"paranoic hardening"}},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_custom_url":null,"og_image_custom_fields":null,"og_image_url":null,"og_image_width":null,"og_image_height":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_image_url":null,"twitter_title":null,"twitter_description":null,"schema_type":"default","schema_type_options":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null,"created":"2026-10-30 07:39:26","updated":"2026-10-30 07:42:29","focus_keyword":"paranoic hardening","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.cisilino.com\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.cisilino.com\/en\/category\/csdn-manual\/\" title=\"CSDN manual\">CSDN manual<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tParanoic Hardening: headers and autologout\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.cisilino.com\/en\/"},{"label":"CSDN manual","link":"https:\/\/www.cisilino.com\/en\/category\/csdn-manual\/"},{"label":"Paranoic Hardening: headers and autologout","link":"https:\/\/www.cisilino.com\/en\/2026\/10\/30\/paranoic-hardening-headers-autologout\/"}],"_links":{"self":[{"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/posts\/1052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/comments?post=1052"}],"version-history":[{"count":2,"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/posts\/1052\/revisions"}],"predecessor-version":[{"id":1327,"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/posts\/1052\/revisions\/1327"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/media\/1005"}],"wp:attachment":[{"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/media?parent=1052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/categories?post=1052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cisilino.com\/en\/wp-json\/wp\/v2\/tags?post=1052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}