Guilherme Dumas Peres

CSP Violation Reporter adds a public WordPress REST endpoint for browser Content Security Policy violation reports and stores received violations in a local database table.
Reports can be reviewed from Tools > CSP Violations. The plugin supports the modern Reporting API payload format as well as the older <code>csp-report</code> JSON shape.
Endpoint:
<pre><code>/wp-json/csp-violation-reporter/v1/report
</code></pre>
The plugin does not create or modify Content Security Policy headers. Site owners should configure CSP headers in their web server, hosting dashboard, theme, or security tooling.
Example report endpoint configuration:
<pre><code>Content-Security-Policy: default-src 'self'; report-uri https://example.com/wp-json/csp-violation-reporter/v1/report
</code></pre>
For the modern Reporting API, use an HTTPS endpoint:
<pre><code>Reporting-Endpoints: csp-endpoint="https://example.com/wp-json/csp-violation-reporter/v1/report"

Content-Security-Policy: default-src 'self'; report-to csp-endpoint
</code></pre>
<h3>Privacy</h3>
This plugin stores CSP violation reports submitted by browsers. Stored fields can include the document URL, referrer URL, blocked URI, violated directive, source file, line and column numbers, a user agent string, a salted hash of the remote address, and the raw report payload.
The plugin does not store raw IP addresses and does not transmit report data to external services.

CSP Violation Reporter

Collect Content Security Policy violation reports through a WordPress REST endpoint and review them in the admin dashboard.

thapa.laxman

The idea is quite simple: By sending a CSP header from a website, you are telling the browser what it is authorized to execute and what it is authorized to block. And by doing this, Content Security Policy helps block the XSS vulnerabilities. 
CSP allows a host to specify a whitelist of approved sources that a browser can load content from and is an effective countermeasure for XSS attacks. 
Content Security Policy is delivered via a HTTP response header, much like HSTS, and defines approved sources of content that the browser may load. It can be an effective countermeasure to Cross Site Scripting (XSS) attacks and is also widely supported and usually easily deployed.
CSP Directives 
* default-src: Define loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback), 
* script-src: Define which scripts the protected resource can execute, 
* object-src: Define from where the protected resource can load plugins, 
* style-src: Define which styles (CSS) the user applies to the protected resource, 
* img-src: Define from where the protected resource can load images, 
* media-src: Define from where the protected resource can load video and audio, 
* frame-src: Define from where the protected resource can embed frames, 
* font-src: Define from where the protected resource can load fonts, 
* connect-src: Define which URIs the protected resource can load using script interfaces, 
* form-action: Define which URIs can be used as the action of HTML form elements, 
* sandbox: Specifies an HTML sandbox policy that the user agent applies to the protected resource, 
* script-nonce: Define script execution by requiring the presence of the specified nonce on script elements, 
* plugin-types: Define the set of plugins that can be invoked by the protected resource by limiting the types of resources that can be embedded, 
* reflected-xss: Instructs a user agent to activate or deactivate any heuristics used to filter or block reflected cross-site scripting attacks, equivalent to the effects of the non-standard X-XSS-Protection header, 
* report-uri: Specifies a URI to which the user agent sends reports about policy violation
<h3>Written By</h3>
This plugin was written by Laxman Thapa, <a href="lakshman.com.np" rel="nofollow ugc">Web Developer</a>.

Content Security Policy Pro

This Content Security Policy plugin will help the setup the Content-Security-Policy HTTP response header and block the XSS vulnerabilities.

CSP Violation Reporter vs Content Security Policy Pro