pieceofcake2 / security-headers

v1.0.6 2026-10-20 07:33 UTC

Requires

• php: >=8.0
• composer/installers: ^1.0 || ^2.0
• pieceofcake2/cakephp: ^2.12

Requires (Dev)

• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^9.6
• pieceofcake2/app: ^2.2
• pieceofcake2/phpcs-cakephp2: ^1.1
• pieceofcake2/phpstan-cakephp2: ^1.0

MIT

• security
• cakephp
• headers
• csp
• cakephp2
• content-security-policy
• hsts

Published on Packagist.org on 2026-10-20 07:33 UTC

README

A dispatcher filter for pieceofcake2/cakephp applications that adds the security headers to every response: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy, and removes X-Powered-By.

The headers that the web server or the CDN should send, such as Strict-Transport-Security, are off by default. The Content Security Policy is sent as Content-Security-Policy-Report-Only by default, so that you can adapt it to your application before enforcing it.

Documentation

• Website: https://pieceofcake2.github.io/security-headers/ (日本語: https://pieceofcake2.github.io/security-headers/ja/)
• Markdown: docs/README.md (日本語: docs/ja/README.md) (for AI tools and offline reading)
• Presets of the services: docs/presets.md (日本語: docs/ja/presets.md)

It covers every setting and its default, the headers for the web server or the CDN, enforcing the Content Security Policy, and changing the headers in an action.

The Markdown documentation is also included in the Composer package, in the plugin's directory: plugins/SecurityHeaders/docs/README.md (the location depends on your installer-paths).

Requirements

• PHP 8.0+
• pieceofcake2/cakephp 2.12+

Installation

composer require pieceofcake2/security-headers

Load the plugin and add the filter in config/bootstrap.php (legacy layout: app/Config/bootstrap.php):

CakePlugin::load('SecurityHeaders');

Configure::write('Dispatcher.filters', [
    'AssetDispatcher',
    'CacheDispatcher',
    'SecurityHeaders.SecurityHeadersFilter',
]);

See Installation for the installer-paths setting.

Usage

Change the settings in config/bootstrap.php:

use PieceOfCake2\SecurityHeaders\ContentSecurityPolicy\GoogleTagManager;

Configure::write('SecurityHeaders', [
    'xFrameOptions' => 'DENY',
    'permissionsPolicy' => 'camera=(), microphone=(), geolocation=(), payment=()',
    // Allows Google Tag Manager and the scripts of a CDN, in addition to those of the site
    'contentSecurityPolicyAllow' => [
        GoogleTagManager::class,
        'cdn' => ['script-src' => ['https://cdn.example.com']],
    ],
]);

A setting is the value of its header, or false not to send it. Classes of the plugin allow the tags, the conversion tags and the embeds of Google, Adobe, Meta (Facebook, Instagram), X, TikTok, LINE, YouTube, Yahoo! JAPAN and Microsoft in the Content Security Policy. See Settings.

Contributing

See the contribution guidelines.

License

Licensed under the MIT License. See LICENSE.