- What does jeffersongoncalves/filament-security-headers do?
- It adds a Filament settings page for laravel-security-headers so you can edit Content Security Policy, response headers, and HSTS from the admin panel. It helps centralize protection against clickjacking, MIME sniffing, and similar web threats, and includes report-only mode for testing CSP before enforcement.
- Which Filament version is required by filament-security-headers 3.0.0?
- Version 3.0.0 is explicitly scoped to Filament 5.x. That is a hard major-version boundary, so it is not a drop-in option for applications still on Filament 4.x or earlier.
- What Laravel and PHP versions does this package support?
- The provided release information does not list exact Laravel or PHP version constraints. Because 3.0.0 targets Filament 5.x, check the package composer.json and your app's Laravel, PHP, and Filament constraints before installing.
- How do I install and register the plugin in a Laravel Filament app?
- Install it with Composer using jeffersongoncalves/filament-security-headers, then register the plugin in your Filament panel provider as described in the package docs. Publish any required config or assets and run migrations only if the package provides them, then verify the settings page in a staging branch.
- How do I configure CSP, response headers, and HSTS from the Filament panel?
- Once the plugin is registered, it exposes a Filament settings page where you can edit the Content Security Policy, response headers, and HSTS settings. Use report-only mode to trial a CSP before enforcing it, and restrict access to the settings page to trusted administrators.
- What is report-only mode and when should I use it?
- Report-only mode sends a Content Security Policy as a report-only policy, so browsers report violations without blocking resources. Use it to trial a policy and inspect reports before switching to enforcement.
- Can I use this package if my app is still on Filament 4?
- It is a poor fit for Filament 4.x or earlier because 3.0.0 requires Filament 5.x. Upgrade the host application to Filament 5 first, or use a package version compatible with your current Filament major if one is available and supported.
- Does version 3.0.0 include migrations or breaking changes from 2.x?
- The one-line release note does not disclose whether 3.0.0 includes migrations, config changes, API changes, or removed features. Treat it as a major migration and request an upgrade guide or changelog from the maintainer before adopting it.
- How should I test this security headers plugin before production?
- Test in staging with report-only CSP, inspect violation reports, and regression-test Filament admin workflows before enforcing. HSTS should be rolled out carefully because browsers cache it, so have a rollback plan and avoid enabling it until HTTPS is fully verified.
- Is this package actively maintained, and what alternatives should I consider?
- The available information does not confirm the maintenance cadence or support policy for 3.0.0. Pin the package version, monitor releases, and ask the maintainer for a changelog, compatibility matrix, and security-fix policy. If you do not need a Filament settings UI, consider configuring laravel-security-headers directly or using another Filament-compatible security plugin after compatibility review.