WP Manifestindependent plugin directory
manifest / security / acsp-builder

aCSP Builder

A WordPress plugin that automatically adds cryptographic nonces to every script & stylesheet, lets you hash-lock inline code, and builds a bullet-proof Content Security Policy in one click. See readme.txt for full description, changelog and installation instructions.

by Awhadi · github.com/awhadi/acsp-builder · website

★ 1stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/awhadi/acsp-builder/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/awhadi/acsp-builder ↗

Version: 1.5.1 Date: 2026-06-17 Author: Awhadi

Summary

aCSP Builder is a WordPress plugin for creating, testing, and managing Content Security Policy headers. Version 1.5.1 refines the admin design, improves Settings export/import guidance, loads the related plugin list dynamically, and removes redundant debug/asset code while preserving existing CSP functionality.

Files Changed

  • acsp-builder.php
  • includes/class-admin.php
  • includes/class-ajax.php
  • includes/class-csp-engine.php
  • includes/class-db.php
  • includes/class-violation-handler.php
  • includes/class-presets.php
  • includes/class-settings.php
  • admin/acsp-about.php
  • admin/acsp-custom-builder.php
  • admin/acsp-presets.php
  • admin/acsp-settings.php
  • admin/acsp-violations.php
  • assets/acsp-builder.js
  • assets/acsp-settings.js
  • assets/acsp-violations.js
  • assets/acsp.css
  • readme.txt
  • CHANGELOG.md

Security And UX Notes

  • Admin pages now use a cleaner CSP-themed design while keeping CSS externalized.
  • Export/import guidance now clearly explains that JSON files include policy and settings.
  • The related plugin list is fetched from the public plugin directory, cached, and falls back to WordPress.org.
  • Verbose report/debug logging was removed to avoid writing CSP report bodies to logs.
  • Existing nonce, hash, reporting, preset, and policy-builder behavior is preserved.

Rollback Plan

Restore version 1.5.0 from the previous plugin package or version control snapshot. No database rollback is required for this release.