Sherlock

• Changed the CSP test to warn instead of fail when a policy allows inline scripts, broad script sources or unsafe eval.
• Changed the Referrer-Policy test to warn instead of fail when the header is missing or does not use a recommended policy.
• Fixed a bug in which some project config settings were not updated when upgrading Sherlock.

• Added PHP 8.4 and 8.5 security support thresholds and a critical PHP security update test for PHP2Shell.
• Improved CSP checks to assess effective script restrictions and recognise enforced frame-ancestors headers as framing protection.
• Changed CORS findings to review warnings instead of failing scans for wildcard access, which may be intentional for public resources.
• Changed the deferred registration password test to consider public registration, email verification and moderator activation instead of warning whenever passwords are deferred.
• Changed the default Referrer-Policy header to strict-origin-when-cross-origin and updated its security test to warn about invalid or less restrictive policies.
• Changed the default Strict-Transport-Security header and security test threshold to one year, and fixed incorrect parsing of max-age values when other directives are present.
• Removed the obsolete X-XSS-Protection header test and default header (#54).
• Fixed HTTPS checks incorrectly passing on HTTP error pages and connection failures.
• Fixed the remembered session threshold to use 14 days.
• Fixed the cooldown duration test to accept indefinite login lockouts.
• Fixed the secure cookie test to verify HTTPS detection in auto mode.

• Added the ability to view read-only settings in environments where admin changes are disallowed (#53).
• Fixed a bug in which an error could be thrown if the latest release of a plugin did not have an associated date (#49).

• Added basic auth username and password settings (#48).
• Added non-CSP, browser-supported directives (#47).

• Improved the processing of comma-separated notification email addresses (#46).

• Fixed a bug in which notification emails were not being sent on newly failed scans (#46).

Added

• Added the maxScans config setting that determines the number of scans Sherlock will keep before it starts deleting the oldest scans.

Changed

• Updated the supported PHP version periods and added 8.3.

Added

• Added compatibility with Craft 5.

Removed

• Removed the expectCT setting.