Guilherme Dumas Peres

CSP Violation Reporter adds a public WordPress REST endpoint for browser Content Security Policy violation reports and stores received violations in a local database table.
Reports can be reviewed from Tools > CSP Violations. The plugin supports the modern Reporting API payload format as well as the older <code>csp-report</code> JSON shape.
Endpoint:
<pre><code>/wp-json/csp-violation-reporter/v1/report
</code></pre>
The plugin does not create or modify Content Security Policy headers. Site owners should configure CSP headers in their web server, hosting dashboard, theme, or security tooling.
Example report endpoint configuration:
<pre><code>Content-Security-Policy: default-src 'self'; report-uri https://example.com/wp-json/csp-violation-reporter/v1/report
</code></pre>
For the modern Reporting API, use an HTTPS endpoint:
<pre><code>Reporting-Endpoints: csp-endpoint="https://example.com/wp-json/csp-violation-reporter/v1/report"

Content-Security-Policy: default-src 'self'; report-to csp-endpoint
</code></pre>
<h3>Privacy</h3>
This plugin stores CSP violation reports submitted by browsers. Stored fields can include the document URL, referrer URL, blocked URI, violated directive, source file, line and column numbers, a user agent string, a salted hash of the remote address, and the raw report payload.
The plugin does not store raw IP addresses and does not transmit report data to external services.

CSP Violation Reporter

Collect Content Security Policy violation reports through a WordPress REST endpoint and review them in the admin dashboard.

Kevin Pirnie

This plugin generates the proper security HTTP response headers, attempts to generate a valid Content Security Policy, and sets browser permissions if configured.

Security Header Generator

Excellent

This plugin generates the proper security HTTP response headers to keep your site secured.

CSP Violation Reporter vs Security Header Generator