Weston Ruter

This plugin enforces a <a href="https://web.dev/articles/strict-csp" rel="nofollow ugc">Strict Content Security Policy</a> (CSP) on the frontend and login screen. This helps mitigate <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS" rel="nofollow ugc">cross-site scripting</a> (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see <a href="https://core.trac.wordpress.org/ticket/59446" rel="nofollow ugc">#59446</a>).
In <a href="https://core.trac.wordpress.org/ticket/58664" rel="nofollow ugc">#58664</a>, the manual construction of script tags was eliminated from <code>WP_Scripts</code> and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in <a href="https://core.trac.wordpress.org/ticket/39941" rel="nofollow ugc">#39941</a>. This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing <code><script></code> tags. Some bundled WordPress core themes <a href="https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+path%3A%2F%5Esrc%5C%2Fwp-content%5C%2Fthemes%5C%2F%2F+%2F%3Cscript%5B%5E%3E%5D*%3E%2F&type=code" rel="nofollow ugc">still do this</a> incorrectly (which has been reported in Trac as <a href="https://core.trac.wordpress.org/ticket/63806" rel="nofollow ugc">#63806</a>). For example, do not do this:
<pre>function my_theme_supports_js() {
 echo '<script>document.body.classList.remove("no-js");</script>'; // ❌
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
Instead, do this:
<pre>function my_theme_supports_js() {
 wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script/" rel="nofollow ugc"><code>wp_enqueue_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_add_inline_script/" rel="nofollow ugc"><code>wp_add_inline_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_localize_script/" rel="nofollow ugc"><code>wp_localize_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_script_tag/" rel="nofollow ugc"><code>wp_print_script_tag()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_inline_script_tag/" rel="nofollow ugc"><code>wp_print_inline_script_tag()</code></a>, and <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script_module/" rel="nofollow ugc"><code>wp_enqueue_script_module()</code></a>. Otherwise, a script’s execution will be blocked and an error will appear in the console, for example:
<blockquote>
Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list.
</blockquote>
This also blocks scripts inside of <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes#event_handler_attributes" rel="nofollow ugc">event handler attributes</a>, such as <code>onclick</code>, <code>onchange</code>, <code>onsubmit</code>, and <code>onload</code>. As noted on MDN:
<blockquote>
Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies.
</blockquote>
This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the <code>nonce</code> attribute added.

Strict CSP

Enforces a Strict Content Security Policy on the frontend and login screen to help mitigate any XSS vulnerabilities.

Hostinger

Hostinger Tools is an all-in-one plugin designed to streamline essential tasks for WordPress site administrators. This plugin offers a range of features to help you manage your site’s information, maintenance mode, security, and redirects effectively.
Features:
Basic Info
<ul>
<li>Displays the current WordPress version with automatic update checks.</li>
<li>Shows the current PHP version with automatic update checks.</li>
</ul>
Maintenance Mode
<ul>
<li>Easily enable or disable maintenance mode for your site.</li>
<li>Provide a URL to bypass maintenance mode for selected users.</li>
</ul>
Security
<ul>
<li>Enable or disable XML-RPC requests to enhance your site’s security.</li>
<li>Enable or disable Authorize application page to enhance your site’s security.</li>
</ul>
Redirects
<ul>
<li>Force all URLs to use HTTPS for secure browsing.</li>
<li>Force all URLs to use WWW to ensure consistency in site access.</li>
</ul>
LLMs.txt Generation
<ul>
<li>Automatically generate a structured LLMs.txt file in Markdown format.</li>
<li>Include website title, description, posts, pages, and products (if WooCommerce is active).</li>
<li>Keep the file updated when content changes or new content is published.</li>
<li>Help AI-powered tools better understand and interact with your website content.</li>
</ul>
Hostinger Tools is the new version of the previous Hostinger plugin, offering an updated and enhanced experience. 
The Onboarding assistant and the Learning section previously included in this plugin were moved to the separate plugin Hostinger Easy Onboarding.

Hostinger Tools


Hostinger is a complete nightmare! Every time I reload or log in to my site, it shows “Checking your browser before accessing. Just a moment…” — both for visitors and admins. On top of that, I get constant cURL timeout errors. I’ve wasted over an hour just trying to install a single plugin — nothing but endless loading! I don’t even use any security or cache plugins, but Hostinger still blames “WordPress.org server issues.” That’s a joke, because the SAME plugin installs instantly on my local site and on other hosting providers without any problem.



And the so-called “support”? It’s not even real support — just a useless AI bot pretending to be helpful. No way to contact a real human! The AI keeps suggesting garbage fixes like “reinstall WordPress” — that’s like telling someone to reinstall Windows every time they see a blue screen. Absolute nonsense! I begged to talk to a real support agent, but the bot arrogantly replies “No need, I can help you.” Seriously?! My issue has been going on for over a month and NOTHING is fixed.



Hostinger wasted my time, destroyed my patience, and their “AI support” is an insult. Worst hosting company ever — I’m giving them 1 star only because 0 stars isn’t possible.


Worst Hosting & Support Ever!


Managing your website just got a whole lot easier!



Even if you’re not from a technical background, the Hostinger Tools plugin is designed with you in mind. Its clean, user-friendly interface makes it simple to manage your website,no coding skills required.




One-click features



Easy navigation



Beginner-friendly design




Whether you're a small business owner, a blogger, or just getting started, this plugin helps you stay in control without the stress.



Website management should feel simple—and now it finally does, WordPress.


Non technical Person Easily Use this plugin.

Simplified WordPress management. Manage site info, maintenance, security, & redirects.

Strict CSP vs Hostinger Tools