Content Security Policy Management Plugin

This plugin allows website administrators to manage their Content Security Policy via a straightforward settings page (requires CMB2) on either the network level, or individual site level. If the plugin is network activated, the CSP will apply to the whole network; if the plugin is single-site activated, the CSP will apply only to that website.

The plugin does not support the addition of hashes to the CSR, due to the complicated implementation in a WordPress environment.

More detail on Content Security Policies can be found at MDN.

Minimum Requirements

This plugin requires:

• WordPress 5.8+
• PHP 8.2+ with the Intl extension

Required Plugins

We currently rely upon CMB2 and CMB2 extensions for settings management, but our eventual goal is to remove these dependencies.
Our full list of dependencies is below:

• CMB2
• CMB2 Message Field

Import/Export

The plugin allows you to import/export the plugin's options as a JSON file, for ease of migration.

Supported Directives

The following directives are configurable using this plugin.

"Global"

Includes Reporting directives, global flags, and other directives that don't fit into another category. The following directives are supported:

Report URI
Sets the reporting destination of CSP violations. The service Report URI is recommended for this.

Report To
Configuration which enables the Reporting API. This field accepts a JSON object.

NEL
Configuration which enables Network Error Logging using the Reporting API. This field accepts a JSON object.

Report Only
Whether the CSP should be enforced, or should only report on violations. Useful for testing a CSP configuration prior to implementation.

Upgrade Insecure Requests
Instructs browsers to treat all HTTP URIs as HTTPS.

Require Trusted Types
Experimental. Enforces Trusted Types to prevent DOM XSS injection.

Allow GTM/GA
Register Google's Trusted Type for GTM/GA.

Enable Script Nonces
Experimental. Activates the addition of a cryptographic nonce to all `