WordPress with CSP Foundry
The WordPress preset opens in Report-Only. It is deliberately loose, because many themes and plugins rely on inline scripts, inline styles and eval.
- Deploy the loose policy as Report-Only through your server config or a headers plugin.
- Create a report endpoint on the Collect tab and add it to the policy.
- Use the site and the admin for a few days and read what is reported.
- Tighten one directive at a time and check the site after each change.
What to know
A WordPress site is an assembly of a core, a theme and many plugins, each of which may add its own inline scripts, inline styles and third-party requests. A strict policy copied from a blog post tends to break the admin area, the editor or a form plugin, and it breaks different things on every site. That is why the safe path starts loose and in Report-Only.
Set the policy where headers are set for the whole site: the web server configuration, a CDN rule, or a headers plugin, rather than a PHP snippet that only covers front-end pages. Keep the admin separate in your thinking: the editor and some plugins use eval and inline scripts, so you may choose to apply a stricter policy to the public site than to wp-admin.
As reports arrive you will see which third parties your plugins call (analytics, fonts, payment, chat). Add those origins deliberately, remove plugins you no longer need, and move inline code to files where you control it. Expect to keep 'unsafe-inline' for a while; the aim is a policy that is accurate and enforced, then improved.
Updated · Cosmovex
Questions
Will a CSP break my WordPress site?
An enforced strict policy can, because themes and plugins use inline scripts and styles. Deploy it as Report-Only first and read the reports before enforcing.
Where do I add a Content-Security-Policy in WordPress?
Prefer the web server or CDN configuration so every response gets the header, including static files and the admin. A headers plugin also works.
Do I need unsafe-eval for WordPress?
Some themes, page builders and parts of the editor use eval, so a policy often needs it at first. Check the reports and remove it once nothing reports it.
Should wp-admin use the same policy?
Not necessarily. The admin and the block editor are more demanding, so many sites apply a looser policy there than on the public site.
The free plan covers everything on this page. CSP Foundry Pro ($9/mo, billed monthly) is described on the CSP Foundry page.
