Weston Ruter

This plugin enforces a <a href="https://web.dev/articles/strict-csp" rel="nofollow ugc">Strict Content Security Policy</a> (CSP) on the frontend and login screen. This helps mitigate <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS" rel="nofollow ugc">cross-site scripting</a> (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see <a href="https://core.trac.wordpress.org/ticket/59446" rel="nofollow ugc">#59446</a>).
In <a href="https://core.trac.wordpress.org/ticket/58664" rel="nofollow ugc">#58664</a>, the manual construction of script tags was eliminated from <code>WP_Scripts</code> and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in <a href="https://core.trac.wordpress.org/ticket/39941" rel="nofollow ugc">#39941</a>. This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing <code><script></code> tags. Some bundled WordPress core themes <a href="https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+path%3A%2F%5Esrc%5C%2Fwp-content%5C%2Fthemes%5C%2F%2F+%2F%3Cscript%5B%5E%3E%5D*%3E%2F&type=code" rel="nofollow ugc">still do this</a> incorrectly (which has been reported in Trac as <a href="https://core.trac.wordpress.org/ticket/63806" rel="nofollow ugc">#63806</a>). For example, do not do this:
<pre>function my_theme_supports_js() {
 echo '<script>document.body.classList.remove("no-js");</script>'; // ❌
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
Instead, do this:
<pre>function my_theme_supports_js() {
 wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script/" rel="nofollow ugc"><code>wp_enqueue_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_add_inline_script/" rel="nofollow ugc"><code>wp_add_inline_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_localize_script/" rel="nofollow ugc"><code>wp_localize_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_script_tag/" rel="nofollow ugc"><code>wp_print_script_tag()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_inline_script_tag/" rel="nofollow ugc"><code>wp_print_inline_script_tag()</code></a>, and <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script_module/" rel="nofollow ugc"><code>wp_enqueue_script_module()</code></a>. Otherwise, a script’s execution will be blocked and an error will appear in the console, for example:
<blockquote>
Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list.
</blockquote>
This also blocks scripts inside of <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes#event_handler_attributes" rel="nofollow ugc">event handler attributes</a>, such as <code>onclick</code>, <code>onchange</code>, <code>onsubmit</code>, and <code>onload</code>. As noted on MDN:
<blockquote>
Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies.
</blockquote>
This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the <code>nonce</code> attribute added.

Strict CSP

Enforces a Strict Content Security Policy on the frontend and login screen to help mitigate any XSS vulnerabilities.

Amrit Anandh

Kuppuraj

infinitewp

<a href="https://infinitewp.com/" title="Manage Multiple WordPress" rel="nofollow ugc">InfiniteWP</a> allows users to manage unlimited number of WordPress sites from their own server.
Main features:
<ul>
<li>Self-hosted system: Resides on your own server and totally under your control</li>
<li>One-click updates for WordPress, plugins and themes across all your sites</li>
<li>Instant backup and restore your entire site or just the database</li>
<li>One-click access to all WP admin panels</li>
<li>Bulk Manage plugins & themes: Activate & Deactive multiple plugins & themes on multiple sites simultaneously</li>
<li>Bulk Install plugins & themes in multiple sites at once</li>
<li>and more..</li>
</ul>
Visit us at <a href="https://infinitewp.com/" title="Manage Multiple WordPress" rel="nofollow ugc">InfiniteWP.com</a>.
Check out the <a href="https://www.youtube.com/watch?v=s35ZoW95cnU" rel="nofollow ugc">InfiniteWP Overview Video</a> below.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/s35ZoW95cnU?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
Credits: <a href="http://prelovac.com/vladimir" rel="nofollow ugc">Vladimir Prelovac</a> for his worker plugin on which the client plugin is being developed.

InfiniteWP Client

We have 100 sites that we manage, update, review and monitor on a daily, weekly and monthly basis for customers.  Infinitewp makes this so simple to manage.  You can instantly see needed updates, You can setup staging sites to manage updates before updating live sites which is essential for our highly custom ecommerce sites.  

Support is top notch.  We have had 2 issues.  One was a 2 second fix where we simply did not RTFM and missed the step.  The other issue was recent and had to do with the recent update in WP All in One Security in which a specific setting was blocking access.  The support team could have taken the easy way and said - this setting is blocking our access, you have to leave it unchecked and not use it, but the infinitewp team did things the right way and updated their plugins to work around the security setting.  

This plugin is well worth the price.  It saves us hours every week and we highly recommend. 

BEST tool for any wordpress dev who manages sites

I have been using InfiniteWP for years, and highly recommend. It provides a quick way to see what sites have updates, and a way to target updating only specific sites/plugins/core. I've tried others, like ManageWP, but they lack features I need, like being able to only update specific plugins, or get a list of all sites I just updated so I can log into each, and check the updates didn't break anything. Most of my clients' sites use WP Engine's Smart Plugin Manager, and I use InfiniteWP so I can ensure the automatic updates keep running (they've stopped on quite a few of my sites, and InfiniteWP is how I track when this happens so I can get the automatic updates running again). I have InfiniteWP set up to send me an email of all sites that have updates daily. Asvin has provided fast, awesome support anytime I've had an issue over the years - which has only happened a couple of times when dealing with more advanced settings.

A must-have to manage site updates

Install this plugin on unlimited sites and manage them all from a central dashboard. This plugin communicates with your InfiniteWP Admin Panel.

Strict CSP vs InfiniteWP Client