The xml file has no manifest part for languages. I suggest to add them.

	<languages>
		<language tag="en-GB">en-GB.plg_system_httpheader.ini</language>
		<language tag="en-GB">en-GB.plg_system_httpheader.sys.ini</language>
	</languages>

There are other things that can be done for customhttpheader.xml but it could be done in another PR;

1. windows eol should be modified to Unix
2. No use to utilize specific strings for Site and Administrator as we already have the global ones, JSITE and JADMINISTRATOR.
3. String PLG_SYSTEM_HTTPHEADER_ADDITIONAL_HEADER_CLIENT="Site selection" proposing Site, Administrator or Both, makes no sense. It should have "Client" as value.

Thanks fixed.

@wilsonge if you have a few minutes please take care that this is merged before the next release as this is going to rename the current plg_system_httpheader to plg_system_httpheaders so it is not going to conflict with the original version currently used in 3.x

I was not aware we had a plg_system_httpheader in 3.x

I was not aware we had a plg_system_httpheader in 3.x

https://github.com/zero-24/plg_system_httpheader

This is the base version for the 4.0.0 and you can use that on any 3.xer site you want :)

Referrer-Policy setting will not save Disabled.

Just pushed the changes for disabled.

Remove extra blank lines.

The Enable default security headers button does nothing.

The Enable default security headers button does nothing.

can you please double check that? It should just enable the plugin currently there is no redirection implemented.

Still disabled. I expect the postinstall message to disappear after clicking the button if the plugin is to be enabled.

Still disabled. I expect the postinstall message to disappear after clicking the button if the plugin is enabled.

Sure. hmm I'm going to debug this one. Maybe i'm also going to redirect the user to the edit page so they can configure the needed values in the plugin if they hit enable. Let's see what is the problem and how to fix it.

I have just fixed the button. A redirect to the plugin edit page is not possible ;)

Yes it is - i did it in the recaptcha v1 pr #19648 or i misunderstand

I'm going to review that proposal. Thanks!

hmm look like this is working. My test before that resulted into a "you are not allowed to use this link directly" error. Now this is fixed. So commit is in coming. Thanks @brianteeman

The default headers are not set. A var dump of $this->params->get('xframeoptions') results in string(1) "1" which is not the same type as ===1.

		// X-Frame-Options
		if ($this->params->get('xframeoptions', 1) === 1)
		{
			$this->app->setHeader('X-Frame-Options', 'SAMEORIGIN');
		}

Thanks should be fixed by the last commit.

I had to save the plugin initially before it would be in effect. 1 should be a string as follows:

get('xframeoptions', '1')

I am testing with your branch rather than via PatchTester. This is the error I get when doing a fresh install. I know it is unrelated to your PR, but how to fix it?
0 Could not create session directory "/var/lib/php/session"

Hmm i have no idea how the session things works nowdays in 4.0 can your user write to that path?

Thanks Tobias :)

?