{"id":30030408,"url":"https://github.com/westonruter/strict-csp","last_synced_at":"2026-05-18T09:36:52.052Z","repository":{"id":307206870,"uuid":"1028696015","full_name":"westonruter/strict-csp","owner":"westonruter","description":"WordPress plugin which enables Strict CSP on the frontend and login screen","archived":false,"fork":false,"pushed_at":"2026-04-28T19:29:11.000Z","size":1577,"stargazers_count":8,"open_issues_count":6,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-05-03T09:33:37.370Z","etag":null,"topics":["wordpress","wordpress-plugin"],"latest_commit_sha":null,"homepage":"https://wordpress.org/plugins/strict-csp/","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/westonruter.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-07-29T23:39:07.000Z","updated_at":"2026-04-28T19:29:15.000Z","dependencies_parsed_at":"2025-12-31T06:02:40.771Z","dependency_job_id":null,"html_url":"https://github.com/westonruter/strict-csp","commit_stats":null,"previous_names":["westonruter/strict-csp"],"tags_count":5,"template":false,"template_full_name":"westonruter/wp-plugin-template","purl":"pkg:github/westonruter/strict-csp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/westonruter%2Fstrict-csp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/westonruter%2Fstrict-csp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/westonruter%2Fstrict-csp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/westonruter%2Fstrict-csp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/westonruter","download_url":"https://codeload.github.com/westonruter/strict-csp/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/westonruter%2Fstrict-csp/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33172787,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-18T09:27:30.708Z","status":"ssl_error","status_checked_at":"2026-05-18T09:27:28.300Z","response_time":71,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["wordpress","wordpress-plugin"],"created_at":"2025-08-06T19:01:37.837Z","updated_at":"2026-05-18T09:36:52.045Z","avatar_url":"https://github.com/westonruter.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Strict CSP\n\nEnforces a Strict Content Security Policy on the frontend and login screen to help mitigate any XSS vulnerabilities.\n\n\u003c!-- markdownlint-disable-next-line no-inline-html --\u003e\n\u003cimg src=\".wordpress-org/banner.svg\" alt=\"Banner for the Strict CSP plugin\" width=\"1544\" height=\"500\"\u003e\n\n**Contributors:** [westonruter](https://profile.wordpress.org/westonruter)  \n**Tags:**         security  \n**Tested up to:** 6.9  \n**Stable tag:**   0.3.2  \n**License:**      [GPLv2 or later](https://www.gnu.org/licenses/old-licenses/gpl-2.0.html)\n\n## Description\n\nThis plugin enforces a [Strict Content Security Policy](https://web.dev/articles/strict-csp) (CSP) on the frontend and login screen. This helps mitigate [cross-site scripting](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS) (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see [#59446](https://core.trac.wordpress.org/ticket/59446)).\n\nIn [#58664](https://core.trac.wordpress.org/ticket/58664), the manual construction of script tags was eliminated from `WP_Scripts` and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in [#39941](https://core.trac.wordpress.org/ticket/39941).  This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing `\u003cscript\u003e` tags. Some bundled WordPress core themes [still do this](https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+path%3A%2F%5Esrc%5C%2Fwp-content%5C%2Fthemes%5C%2F%2F+%2F%3Cscript%5B%5E%3E%5D*%3E%2F\u0026type=code) incorrectly (which has been reported in Trac as [#63806](https://core.trac.wordpress.org/ticket/63806)). For example, do not do this:\n\n```php\nfunction my_theme_supports_js() {\n\techo '\u003cscript\u003edocument.body.classList.remove(\"no-js\");\u003c/script\u003e'; // ❌\n}\nadd_action( 'wp_footer', 'my_theme_supports_js' );\n```\n\nInstead, do this:\n\n```php\nfunction my_theme_supports_js() {\n\twp_print_inline_script_tag( 'document.body.classList.remove(\"no-js\");' ); // ✅\n}\nadd_action( 'wp_footer', 'my_theme_supports_js' );\n```\n\nSo in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including [`wp_enqueue_script()`](https://developer.wordpress.org/reference/functions/wp_enqueue_script/), [`wp_add_inline_script()`](https://developer.wordpress.org/reference/functions/wp_add_inline_script/), [`wp_localize_script()`](https://developer.wordpress.org/reference/functions/wp_localize_script/), [`wp_print_script_tag()`](https://developer.wordpress.org/reference/functions/wp_print_script_tag/), [`wp_print_inline_script_tag()`](https://developer.wordpress.org/reference/functions/wp_print_inline_script_tag/), and [`wp_enqueue_script_module()`](https://developer.wordpress.org/reference/functions/wp_enqueue_script_module/). Otherwise, a script's execution will be blocked and an error will appear in the console, for example:\n\n\u003e Refused to execute inline script because it violates the following Content Security Policy directive: \"script-src 'nonce-9b539cfe47' 'unsafe-inline' 'strict-dynamic' https: http:\". Note that 'unsafe-inline' is ignored if either a hash or nonce value is present in the source list.\n\nThis also blocks scripts inside of [event handler attributes](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes#event_handler_attributes), such as `onclick`, `onchange`, `onsubmit`, and `onload`. As noted on MDN:\n\n\u003e Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies.\n\nThis plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the `nonce` attribute added.\n\n## Installation\n\n### Automatic\n\n1. Visit **Plugins \u003e Add New** in the WordPress Admin.\n2. Search for **Strict CSP**.\n3. Install and activate the **Strict CSP** plugin.\n4. Log out of WordPress and log back in with the “Remember Me” checkbox checked.\n\nYou may also install and update via [Git Updater](https://git-updater.com/) using the [plugin's GitHub URL](https://github.com/westonruter/strict-csp).\n\n### Manual\n\n1. Download the plugin ZIP either [from WordPress.org](https://downloads.wordpress.org/plugin/strict-csp.zip) or [from GitHub](https://github.com/westonruter/strict-csp/archive/refs/heads/main.zip). Alternatively, if you have a local clone of the repo, run `npm run plugin-zip`.\n2. Visit **Plugins \u003e Add New Plugin** in the WordPress Admin.\n3. Click **Upload Plugin**.\n4. Select the `strict-csp.zip` file on your system from step 1 and click **Install Now**.\n5. Click the **Activate Plugin** button.\n\n## Changelog\n\n### 0.3.2\n\n* Use `wp_generate_password()` to create CSP nonce instead of using `wp_create_nonce()`. Props [kasparsd](https://profiles.wordpress.org/kasparsd/). ([#13](https://github.com/westonruter/strict-csp/pull/13))\n\n### 0.3.1\n\n* Update required PHP version to 7.2 instead of 8.1.\n\n### 0.3.0\n\n* Add `nonce` attributes to scripts added by embeds.\n\n### 0.2.0\n\n* Disable Strict CSP from Site Editor.\n* Restrict policy to frontend and login screen.\n\n### 0.1.0\n\n* Initial release.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwestonruter%2Fstrict-csp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwestonruter%2Fstrict-csp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwestonruter%2Fstrict-csp/lists"}