v1.5.0

Added

• X-Original-URL and X-Rewrite-URL added to the always-reject header set. These IIS-style URL-rewrite headers are honored by some PHP/WordPress configurations and can override REQUEST_URI server-side, enabling cache poisoning where the cache keys on the original URL but WordPress responds based on the rewritten one.
• Silent-strip pass for host-poisoning headers: X-Forwarded-Host, X-Host, X-Original-Host, X-Forwarded-Server. Stripped from $_SERVER on every request so WordPress falls back to HTTP_HOST (set correctly by the origin web server) when generating absolute URLs in canonical links, og:url, password-reset emails, RSS feeds, and similar surfaces. No 400 — these headers are routinely inserted by upstream proxies on legitimate traffic and rejecting would break it.
• STRIP_HEADERS constant introduced to distinguish the silent-strip set from the always-reject set.
• REJECT_HEADERS constant added; OVERRIDE_HEADERS retained as a backwards-compatible alias.
• Vary header on rejected requests and on filtered REST API responses now includes the URL-rewrite headers in addition to the method-override headers.

Changed

• Rejection error code generalized from method_override_not_allowed to request_header_not_allowed since the reject set now covers both method-override and URL-rewrite vectors.
• Late-bound strip_method_override_headers() (init priority 1 fallback) now also strips the new reject and silent-strip header sets.

Security

• Addresses follow-up Bugcrowd researcher concern (Comcast PSIRT, 04-02-26) that the v1.4.0 fix was too narrow: "cache poisoning is not limited to this header. Other unkeyed inputs (e.g., X-Forwarded-Host, X-Host, or query variations) may still influence cached responses." This release expands application-layer coverage to the broader header class. Cache-key strategy and edge-layer treatment of unkeyed inputs remain a Pagely-side concern (see pagely-support-ticket.md).

v1.4.0

enhancements

v1.3.3

zipball fix

v1.3.2

added check for updates

v1.3.1

bugfix

v1.3.0

Restricts REST API endpoints

v1.2.0

Changed

• BREAKING: Requests with method override headers now receive 400 Bad Request instead of being silently processed
• Early rejection strategy replaces header stripping to prevent upstream cache poisoning
• Aggressive no-cache headers added to rejected requests to prevent Pagely ARES caching

Added

• early_reject_override_requests() static method for immediate request rejection
• Pagely-specific cache control headers (X-Accel-Expires, Surrogate-Control)
• JSON error response body for rejected requests with method_override_not_allowed code
• Expires header set to epoch for maximum cache prevention compatibility
• GitHub auto-updater: Plugin now checks for updates from GitHub releases automatically
• "View releases on GitHub" link added to plugin row meta on Plugins page
• Plugin details popup shows release notes from GitHub

Security

• Fixes incomplete cache poisoning mitigation where stripped headers still resulted in cacheable 200 responses
• Addresses CVE-related finding where Pagely ARES cached responses without keying on X-Http-Method-Override header
• 400 responses with no-store prevent poisoned entries from entering the cache layer

Deprecated

• early_strip_headers() method (now calls early_reject_override_requests() for backwards compatibility)

v1.1.0

Hardened and stabilized