{"id":2128,"date":"2026-05-23T08:13:09","date_gmt":"2026-05-23T05:13:09","guid":{"rendered":"https:\/\/allinonewpsettings.com\/blog\/?p=2128"},"modified":"2026-08-02T12:09:34","modified_gmt":"2026-08-02T12:09:34","slug":"wordpress-htaccess-guvenlik-basliklari-hsts-csp-ve-daha-fazlasi","status":"publish","type":"post","link":"https:\/\/allinonewpsettings.com\/blog\/tr\/wordpress-htaccess-guvenlik-basliklari-hsts-csp-ve-daha-fazlasi\/","title":{"rendered":"WordPress’te .htaccess ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131: HSTS, CSP ve Daha Fazlas\u0131"},"content":{"rendered":"

Bir g\u00fcvenlik taramas\u0131n\u0131n \u00f6nerilerini oldu\u011fu gibi .htaccess<\/code> dosyas\u0131na eklemek, puan\u0131 y\u00fckseltirken siteyi bozabilir. Kat\u0131 bir CSP \u00f6deme iframe’ini veya edit\u00f6r betiklerini engelleyebilir; erken a\u00e7\u0131lan includeSubDomains<\/code> ise HTTPS’e haz\u0131r olmayan bir alt alan\u0131 eri\u015filemez h\u00e2le getirebilir.<\/p>\n

G\u00fcvenlik ba\u015fl\u0131klar\u0131 ancak sitenin ger\u00e7ek kaynaklar\u0131, alt alanlar\u0131 ve proxy\/CDN yap\u0131s\u0131 bilindi\u011finde g\u00fcvenle uygulanabilir. Bu rehberde HSTS, CSP ve di\u011fer yayg\u0131n ba\u015fl\u0131klar\u0131 ne i\u015fe yarad\u0131klar\u0131na g\u00f6re ay\u0131r\u0131yor; de\u011fi\u015fiklikleri a\u015famal\u0131 bi\u00e7imde yay\u0131nlay\u0131p taray\u0131c\u0131ya ula\u015fan son yan\u0131t\u0131 do\u011frulamay\u0131 ele al\u0131yoruz.<\/p>\n

\n\u0130\u00e7indekiler<\/strong><\/p>\n
    \n
  1. G\u00fcvenlik ba\u015fl\u0131klar\u0131 ne i\u015fe yarar?<\/a><\/li>\n
  2. Ger\u00e7ek\u00e7i bir WordPress \u00f6rne\u011fi<\/a><\/li>\n
  3. Hangi ba\u015fl\u0131k ne zaman kullan\u0131lmal\u0131?<\/a><\/li>\n
  4. Yeni ba\u015flayanlar i\u00e7in g\u00fcvenli uygulama<\/a><\/li>\n
  5. \u0130leri teknik yakla\u015f\u0131m<\/a><\/li>\n
  6. Riskler, s\u0131k hatalar, yedek ve rollback<\/a><\/li>\n
  7. AIOWS Htaccess D\u00fczenleyici nas\u0131l yard\u0131mc\u0131 olur?<\/a><\/li>\n
  8. \u0130lgili AIOWS yaz\u0131lar\u0131<\/a><\/li>\n
  9. Sonu\u00e7 ve \u00f6nerilen yol<\/a><\/li>\n
  10. Resm\u00ee kaynaklar<\/a><\/li>\n<\/ol>\n<\/div>\n

    G\u00fcvenlik ba\u015fl\u0131klar\u0131 ne i\u015fe yarar?<\/h2>\n

    HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131, taray\u0131c\u0131n\u0131n bir yan\u0131t\u0131 nas\u0131l i\u015fleyece\u011fini belirtir. Strict-Transport-Security<\/code> (HSTS) belirli bir s\u00fcre boyunca yaln\u0131zca HTTPS kullan\u0131lmas\u0131n\u0131 ister. Content-Security-Policy<\/code> (CSP) betik, stil, g\u00f6rsel, font, frame ve ba\u011flant\u0131 kaynaklar\u0131n\u0131 s\u0131n\u0131rlar. X-Content-Type-Options<\/code>, Referrer-Policy<\/code> ve Permissions-Policy<\/code> ise s\u0131ras\u0131yla MIME t\u00fcr\u00fc yorumlama, y\u00f6nlendiren adres bilgisi ve taray\u0131c\u0131 \u00f6zellikleri \u00fczerinde denetim sa\u011flar.<\/p>\n

    Bu ba\u015fl\u0131klar uygulama a\u00e7\u0131\u011f\u0131n\u0131 otomatik olarak d\u00fczeltmez. Taray\u0131c\u0131n\u0131n davran\u0131\u015f\u0131n\u0131 daraltarak baz\u0131 sald\u0131r\u0131lar\u0131n etkisini azalt\u0131r. De\u011ferler sitenin ger\u00e7ek kullan\u0131m\u0131na uymuyorsa giri\u015f, \u00f6deme, medya, analiz veya edit\u00f6r i\u015flevleri de engellenebilir.<\/p>\n

    Ger\u00e7ek\u00e7i bir WordPress \u00f6rne\u011fi<\/h2>\n

    Bir WooCommerce sitesi, haz\u0131r bir \u015fablondan HSTS ile zorunlu CSP ba\u015fl\u0131klar\u0131n\u0131 ayn\u0131 anda ekliyor. CSP, \u00f6deme sa\u011flay\u0131c\u0131s\u0131n\u0131n iframe’ini ve \u00e7erez y\u00f6netim arac\u0131n\u0131 engelliyor. HSTS i\u00e7indeki includeSubDomains<\/code> se\u00e7ene\u011fi de sertifikas\u0131 bulunmayan eski bir destek alt alan\u0131n\u0131 eri\u015filemez h\u00e2le getiriyor.<\/p>\n

    Ekip \u00f6nce de\u011fi\u015fikli\u011fi geri al\u0131yor, ard\u0131ndan CSP’yi Content-Security-Policy-Report-Only<\/code> olarak yay\u0131ml\u0131yor. Taray\u0131c\u0131 konsolu ve raporlar \u00fczerinden \u00f6deme, analitik, font ve CDN kaynaklar\u0131n\u0131 \u00e7\u0131kar\u0131yor. HSTS ise yaln\u0131zca ana alan ve b\u00fct\u00fcn ilgili alt alanlar\u0131n kal\u0131c\u0131 HTTPS kulland\u0131\u011f\u0131 do\u011fruland\u0131ktan sonra k\u0131sa bir s\u00fcreyle ba\u015flat\u0131l\u0131yor.<\/p>\n

    Hangi ba\u015fl\u0131k ne zaman kullan\u0131lmal\u0131?<\/h2>\n

    CSP, sayfan\u0131n y\u00fcklemesine izin verilen kaynaklar\u0131 a\u00e7\u0131k\u00e7a tan\u0131mlamak istedi\u011finizde kullan\u0131l\u0131r. Envanter haz\u0131rlamadan yaln\u0131zca tarama sonucuna bakarak uygulanmamal\u0131d\u0131r. script-src<\/code>, style-src<\/code>, img-src<\/code>, font-src<\/code>, connect-src<\/code> ve frame-src<\/code> de\u011ferleri sitenin kulland\u0131\u011f\u0131 ger\u00e7ek hizmetlerle e\u015fle\u015fmelidir. Ba\u015fka sitelerin sizin sayfan\u0131z\u0131 iframe i\u00e7inde a\u00e7mas\u0131n\u0131 s\u0131n\u0131rlamak i\u00e7inse frame-ancestors<\/code> gerekir.<\/p>\n

    HSTS, HTTP eri\u015fimini HTTPS’e kal\u0131c\u0131 bi\u00e7imde zorlamak i\u00e7in etkilidir; ancak taray\u0131c\u0131 karar\u0131 belirlenen s\u00fcre boyunca hat\u0131rlar. Dosyay\u0131 geri almak, daha \u00f6nce al\u0131nm\u0131\u015f HSTS karar\u0131n\u0131 hemen silmez. includeSubDomains<\/code> b\u00fct\u00fcn alt alanlar\u0131 kapsar; preload<\/code> ise ayr\u0131ca uzun vadeli ve d\u0131\u015far\u0131dan y\u00f6netilen bir taahh\u00fctt\u00fcr. Bu se\u00e7enekler yaln\u0131zca kapsam i\u00e7indeki her hostun HTTPS’e haz\u0131r oldu\u011fu kan\u0131tland\u0131ktan sonra d\u00fc\u015f\u00fcn\u00fclmelidir.<\/p>\n

    Referrer-Policy<\/code> se\u00e7ilirken \u00f6deme d\u00f6n\u00fc\u015fleri, sat\u0131\u015f ortakl\u0131\u011f\u0131 \u00f6l\u00e7\u00fcm\u00fc ve \u00fc\u00e7\u00fcnc\u00fc taraf entegrasyonlar\u0131 kontrol edilmelidir. Permissions-Policy<\/code> kamera, mikrofon veya konum gibi \u00f6zellikleri s\u0131n\u0131rlar; ger\u00e7ekten kullan\u0131lan g\u00f6m\u00fcl\u00fc hizmetleri istemeden devre d\u0131\u015f\u0131 b\u0131rakmamal\u0131d\u0131r. CORS ba\u015fl\u0131klar\u0131 ise farkl\u0131 bir ama\u00e7 ta\u015f\u0131r ve g\u00fcvenlik taramas\u0131 i\u00e7in geli\u015fig\u00fczel eklenmemelidir.<\/p>\n

    Yeni ba\u015flayanlar i\u00e7in g\u00fcvenli uygulama<\/h2>\n
      \n
    1. Origin ve CDN \u00fczerinden gelen mevcut yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 ayr\u0131 ayr\u0131 kaydedin. Ayn\u0131 ba\u015fl\u0131\u011f\u0131n birden fazla katmanda tan\u0131mlan\u0131p tan\u0131mlanmad\u0131\u011f\u0131n\u0131 belirleyin.<\/li>\n
    2. Etkin .htaccess<\/code> dosyas\u0131n\u0131 yedekleyin; hosting paneli veya FTP \u00fczerinden WordPress d\u0131\u015f\u0131nda eri\u015febilece\u011finiz bir geri d\u00f6n\u00fc\u015f yolu haz\u0131rlay\u0131n.<\/li>\n
    3. \u00d6nce X-Content-Type-Options<\/code> gibi kapsam\u0131 daha kolay do\u011frulanabilen bir ba\u015fl\u0131kla ba\u015flay\u0131n.<\/li>\n
    4. CSP’yi zorunlu moda almadan \u00f6nce report-only olarak \u00e7al\u0131\u015ft\u0131r\u0131n. Giri\u015f, edit\u00f6r, form, medya, \u00f6deme, analitik, callback ve g\u00f6m\u00fcl\u00fc i\u00e7erik ak\u0131\u015flar\u0131n\u0131 s\u0131nay\u0131n.<\/li>\n
    5. HSTS i\u00e7in k\u0131sa bir max-age<\/code> ile ba\u015flay\u0131n. B\u00fct\u00fcn alt alanlar do\u011frulanmadan includeSubDomains<\/code> veya preload<\/code> kullanmay\u0131n.<\/li>\n
    6. Temiz bir taray\u0131c\u0131 oturumunda hem \u00f6n y\u00fcz\u00fc hem y\u00f6netim panelini kontrol edin; CDN \u00f6nbelle\u011fini temizledikten sonra son ba\u015fl\u0131klar\u0131 yeniden inceleyin.<\/li>\n<\/ol>\n

      \u0130leri teknik yakla\u015f\u0131m<\/h2>\n

      Geli\u015fmi\u015f yap\u0131land\u0131rmada her ba\u015fl\u0131\u011f\u0131n tek bir sorumlusu olmal\u0131d\u0131r. Apache, WordPress eklentisi, reverse proxy ve CDN ayn\u0131 ba\u015fl\u0131\u011f\u0131 farkl\u0131 de\u011ferlerle eklerse taray\u0131c\u0131 beklenenden daha kat\u0131 davranabilir. \u00d6zellikle birden fazla CSP ba\u015fl\u0131\u011f\u0131 birbirinin alternatifi say\u0131lmaz; t\u00fcm politikalar birlikte uygulan\u0131r.<\/p>\n