Guilherme Dumas Peres

<p>CSP Violation Reporter adds a public WordPress REST endpoint for browser Content Security Policy violation reports and stores received violations in a local database table.</p>
<p>Reports can be reviewed from Tools > CSP Violations. The plugin supports the modern Reporting API payload format as well as the older <code>csp-report</code> JSON shape.</p>
<p>Endpoint:</p>
<pre><code>/wp-json/csp-violation-reporter/v1/report
</code></pre>
<p>The plugin does not create or modify Content Security Policy headers. Site owners should configure CSP headers in their web server, hosting dashboard, theme, or security tooling.</p>
<p>Example report endpoint configuration:</p>
<pre><code>Content-Security-Policy: default-src 'self'; report-uri https://example.com/wp-json/csp-violation-reporter/v1/report
</code></pre>
<p>For the modern Reporting API, use an HTTPS endpoint:</p>
<pre><code>Reporting-Endpoints: csp-endpoint="https://example.com/wp-json/csp-violation-reporter/v1/report"

Content-Security-Policy: default-src 'self'; report-to csp-endpoint
</code></pre>
<h3>Privacy</h3>
<p>This plugin stores CSP violation reports submitted by browsers. Stored fields can include the document URL, referrer URL, blocked URI, violated directive, source file, line and column numbers, a user agent string, a salted hash of the remote address, and the raw report payload.</p>
<p>The plugin does not store raw IP addresses and does not transmit report data to external services.</p>


CSP Violation Reporter

Collect Content Security Policy violation reports through a WordPress REST endpoint and review them in the admin dashboard.

Milan Petrovic

<p>Configure various security-related HTTP headers, including Content Security Policy, Feature Policy, Referrer Policy and more. For CSP and XSS plugin supports report logging with 2 additional database tables to store reports from browsers.</p>
<h4>Supported security headers</h4>
<p>The plugin has support for the following HTTP headers:</p>
<ul>
<li>Content Security Policy (CSP) – with reporting</li>
<li>XSS Protection (XXP) – with reporting</li>
<li>Feature Policy (Permissions Policy)</li>
<li>Content Type – No Sniff Policy</li>
<li>Strict Transport Security</li>
<li>Referrer Policy</li>
<li>Frame Options</li>
</ul>
<p>For CSP, the plugin allows you to set rules for all currently supported directives, additional settings including setting the policy in Report or Live mode. The plugin also includes special extensions that can automatically fill CSP rules for popular Google services you might be using on your website (Fonts, Maps, Adsense, Analytics, TagManager and more) and other popular services (Gravatar, Instagram, PayPal Vimeo and more).</p>
<p>And, for Feature Policy (or Permissions Policy), the plugin allows you to set rules for all currently supported rules (over 25 rules, supported by different browsers).</p>
<h4>FLoC / Browsing Topics</h4>
<p>Permissions Policy rules list includes ‘browsing-topics’ rule that can be used to disable Google’s new tracking method ‘Browsing Topics API’ (which replaced ‘Federated Learning of Cohorts’ or ‘FLoC’).</p>
<h4>Methods for adding headers</h4>
<p>The plugin can add all the generated headers into HTACCESS file (for Apache web servers), and they will be applied to all files, not just WordPress generated content. If your website is not using Apache (or .HTACCESS), all rules are generated with each page request and will work with any server type.</p>
<p>And, if you don’t use Apache web server, the plugin has a panel where it displays generated headers for most popular servers: Apache, Nginx and IIS, and you can copy generated headers to add to server configuration files.</p>
<h4>About the plugin</h4>
<ul>
<li>More information about <a href="https://plugins.dev4press.com/gd-security-headers/" rel="nofollow ugc">GD Security Headers</a></li>
<li>Support and Knowledge Base for <a href="https://support.dev4press.com/kb/product/gd-security-headers/" rel="nofollow ugc">GD Security Headers</a></li>
</ul>


GD Security Headers

Configure various security-related HTTP headers, including CSP, XSS, Referrer Policy and more.

CSP Violation Reporter vs GD Security Headers