Weston Ruter

<p>This plugin enforces a <a href="https://web.dev/articles/strict-csp" rel="nofollow ugc">Strict Content Security Policy</a> (CSP) on the frontend and login screen. This helps mitigate <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS" rel="nofollow ugc">cross-site scripting</a> (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see <a href="https://core.trac.wordpress.org/ticket/59446" rel="nofollow ugc">#59446</a>).</p>
<p>In <a href="https://core.trac.wordpress.org/ticket/58664" rel="nofollow ugc">#58664</a>, the manual construction of script tags was eliminated from <code>WP_Scripts</code> and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in <a href="https://core.trac.wordpress.org/ticket/39941" rel="nofollow ugc">#39941</a>.  This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing <code><script></code> tags. Some bundled WordPress core themes <a href="https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+path%3A%2F%5Esrc%5C%2Fwp-content%5C%2Fthemes%5C%2F%2F+%2F%3Cscript%5B%5E%3E%5D*%3E%2F&type=code" rel="nofollow ugc">still do this</a> incorrectly (which has been reported in Trac as <a href="https://core.trac.wordpress.org/ticket/63806" rel="nofollow ugc">#63806</a>). For example, do not do this:</p>
<pre>function my_theme_supports_js() {
    echo '<script>document.body.classList.remove("no-js");</script>'; // ❌
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
<p>Instead, do this:</p>
<pre>function my_theme_supports_js() {
    wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
<p>So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script/" rel="nofollow ugc"><code>wp_enqueue_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_add_inline_script/" rel="nofollow ugc"><code>wp_add_inline_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_localize_script/" rel="nofollow ugc"><code>wp_localize_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_script_tag/" rel="nofollow ugc"><code>wp_print_script_tag()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_inline_script_tag/" rel="nofollow ugc"><code>wp_print_inline_script_tag()</code></a>, and <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script_module/" rel="nofollow ugc"><code>wp_enqueue_script_module()</code></a>. Otherwise, a script’s execution will be blocked and an error will appear in the console, for example:</p>
<blockquote>
<p>Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list.</p>
</blockquote>
<p>This also blocks scripts inside of <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes#event_handler_attributes" rel="nofollow ugc">event handler attributes</a>, such as <code>onclick</code>, <code>onchange</code>, <code>onsubmit</code>, and <code>onload</code>. As noted on MDN:</p>
<blockquote>
<p>Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies.</p>
</blockquote>
<p>This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the <code>nonce</code> attribute added.</p>


Strict CSP

Enforces a Strict Content Security Policy on the frontend and login screen to help mitigate any XSS vulnerabilities.

mainwp

<p><strong>The MainWP Child Plugin securely connects the WordPress sites you want to manage to the <a href="https://wordpress.org/plugins/mainwp/" rel="ugc">MainWP Dashboard</a>.</strong></p>
<p>The MainWP Child plugin creates a secure connection between your WordPress sites and your self-hosted MainWP Dashboard, enabling you to efficiently manage WP installations from a single, centralized location.</p>
<p>With MainWP Child and the MainWP Dashboard, you can update themes, plugins, and WordPress core across all connected sites, perform backups and security scans, manage posts, pages, users, and comments in bulk, and integrate with popular plugins like WooCommerce, Yoast SEO, and Wordfence.</p>
<p>The <a href="https://wordpress.org/plugins/mainwp/" rel="ugc">MainWP Dashboard</a> also offers features for cost tracking and client management, making it an all-in-one solution for agencies and freelancers looking to manage WP sites efficiently. The functionality can be further extended with a growing library of <a href="https://mainwp.com/mainwp-add-ons/" rel="nofollow ugc">MainWP Add-ons</a>.</p>
<p><a href="https://mainwp.com/" rel="nofollow ugc">MainWP</a> is the ideal solution for freelancers and agencies managing client sites, developers and designers working on multiple projects, marketers and content managers overseeing various websites, and anyone responsible for maintaining multiple WordPress sites.</p>
<h4>Why Choose MainWP for WordPress Management?</h4>
<p>MainWP is 100% free and open-source, with no monthly fees, even for unlimited sites.</p>
<p>As a self-hosted solution, it offers maximum control and privacy. MainWP provides comprehensive site management features and is highly customizable with add-ons and developer hooks.  The MainWP Child plugin even comes with its own privacy policy to guarantee your <a href="https://mainwp.com/mainwp-plugin-privacy-policy/" rel="nofollow ugc">privacy while using MainWP</a>.</p>
<p>All of this makes MainWP the best non-SaaS alternative to ManageWP, InfiniteWP, WPRemote, and WP Umbrella.</p>
<h4>Key Features</h4>
<p>MainWP Child, combined with the MainWP Dashboard, offers secure management of unlimited WordPress sites, one-click updates for plugins, themes, and WordPress core, automated backups and security monitoring, bulk management of posts, pages, users, and comments, white-labeling and custom branding options, and <a href="https://mainwp.com/mainwp-add-ons/" rel="nofollow ugc">powerful add-ons</a> for WooCommerce, Yoast SEO, Wordfence, and more.</p>
<h4>Expand Your MainWP Dashboard with Add-ons</h4>
<p>MainWP offers a growing library of add-ons that add advanced functionality to your Dashboard. From client reporting to SEO management, MainWP add-ons provide the tools you need to deliver top-notch service to your clients.</p>
<h4>Join the MainWP Community</h4>
<p>MainWP is more than just a plugin; it’s a thriving community of WordPress professionals. Join our <a href="https://www.facebook.com/groups/MainWPUsers/" rel="nofollow ugc">MainWP Users Facebook Group</a> to connect with other users, share advice, and stay updated on the latest features and add-ons.</p>
<h4>Developer-Friendly</h4>
<p>MainWP is built with developers in mind. We provide extensive documentation, hooks, and an API to help you create custom extensions and integrations for the MainWP platform.  We have a site at <a href="https://mainwp.dev" rel="nofollow ugc">MainWP.dev</a> dedicated to MainWP developers.</p>
<h4>Get Started with MainWP Today</h4>
<p>Take control of your WordPress site management with MainWP and the MainWP Child plugin. With its powerful features, unlimited site connections, and user-friendly interface, MainWP is the smart choice for anyone managing multiple WordPress sites.</p>
<h4>Learn More About MainWP</h4>
<ul>
<li><a href="https://mainwp.com" rel="nofollow ugc">MainWP Website</a></li>
<li><a href="https://mainwp.com/kb/" rel="nofollow ugc">MainWP Documentation</a></li>
<li><a href="https://community.mainwp.com/c/support/mainwp-support/" rel="nofollow ugc">MainWP Support</a></li>
<li><a href="https://mainwp.com/blog/" rel="nofollow ugc">MainWP Blog</a></li>
<li><a href="https://github.com/mainwp/" rel="nofollow ugc">MainWP on GitHub</a></li>
</ul>


MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

MainWP Child establishes a secure link between your WordPress sites and your self-hosted MainWP Dashboard, simplifying site management.

Strict CSP vs MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites