Weston Ruter

<p>This plugin enforces a <a href="https://web.dev/articles/strict-csp" rel="nofollow ugc">Strict Content Security Policy</a> (CSP) on the frontend and login screen. This helps mitigate <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS" rel="nofollow ugc">cross-site scripting</a> (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see <a href="https://core.trac.wordpress.org/ticket/59446" rel="nofollow ugc">#59446</a>).</p>
<p>In <a href="https://core.trac.wordpress.org/ticket/58664" rel="nofollow ugc">#58664</a>, the manual construction of script tags was eliminated from <code>WP_Scripts</code> and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in <a href="https://core.trac.wordpress.org/ticket/39941" rel="nofollow ugc">#39941</a>.  This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing <code><script></code> tags. Some bundled WordPress core themes <a href="https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+path%3A%2F%5Esrc%5C%2Fwp-content%5C%2Fthemes%5C%2F%2F+%2F%3Cscript%5B%5E%3E%5D*%3E%2F&type=code" rel="nofollow ugc">still do this</a> incorrectly (which has been reported in Trac as <a href="https://core.trac.wordpress.org/ticket/63806" rel="nofollow ugc">#63806</a>). For example, do not do this:</p>
<pre>function my_theme_supports_js() {
    echo '<script>document.body.classList.remove("no-js");</script>'; // ❌
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
<p>Instead, do this:</p>
<pre>function my_theme_supports_js() {
    wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
<p>So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script/" rel="nofollow ugc"><code>wp_enqueue_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_add_inline_script/" rel="nofollow ugc"><code>wp_add_inline_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_localize_script/" rel="nofollow ugc"><code>wp_localize_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_script_tag/" rel="nofollow ugc"><code>wp_print_script_tag()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_inline_script_tag/" rel="nofollow ugc"><code>wp_print_inline_script_tag()</code></a>, and <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script_module/" rel="nofollow ugc"><code>wp_enqueue_script_module()</code></a>. Otherwise, a script’s execution will be blocked and an error will appear in the console, for example:</p>
<blockquote>
<p>Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list.</p>
</blockquote>
<p>This also blocks scripts inside of <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes#event_handler_attributes" rel="nofollow ugc">event handler attributes</a>, such as <code>onclick</code>, <code>onchange</code>, <code>onsubmit</code>, and <code>onload</code>. As noted on MDN:</p>
<blockquote>
<p>Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies.</p>
</blockquote>
<p>This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the <code>nonce</code> attribute added.</p>


Strict CSP

Enforces a Strict Content Security Policy on the frontend and login screen to help mitigate any XSS vulnerabilities.

Vladimir Prelovac

ManageWP

<p>So you’re looking for a better way to manage WordPress websites? We have you covered! <a href="https://managewp.com/" title="Manage Multiple WordPress Websites" rel="nofollow ugc">ManageWP</a> is a dashboard that helps you save time and nerves by automating your workflow, so you could focus on things that matter. It is fast, secure and free for an unlimited number of websites.</p>
<h4>Everything in One Place</h4>
<p>Just the hassle of logging into each of your websites is enough to ruin your day. ManageWP compiles the data from all of your sites on one dashboard, so you can check up on your websites in a single glance. And if you need to take a better look at a particular website, you’re just a click away. <a href="https://managewp.com/features/1-click-login" title="1-click login" rel="nofollow ugc">Read more</a></p>
<h4>Bulk actions</h4>
<p>57 updates on 12 sites? Update them all with a single click. And it’s not just updates. Clean spam, database overhead, run security checks and more – with just one click you can do these things on all your websites at once. <a href="https://managewp.com/features/manage-plugins-and-themes" title="Manage plugins & themes" rel="nofollow ugc">Read more</a></p>
<h4>Cloud Backup that just works</h4>
<p>A reliable backup is the backbone of any business. And we have a free monthly backup for all of your websites. It’s, incremental, reliable, and works where other backup solutions fail. The free Backup includes monthly scheduled backup, off-site storage, 1-click restore, US/EU storage choice and the option to exclude files and folders. The premium Backup gives you on-demand backups, weekly/daily/hourly backup cycles & <a href="https://managewp.com/features/backup" title="ManageWP Backup" rel="nofollow ugc">more</a>.</p>
<h4>Safe updates</h4>
<p>Updating plugins & themes is a huge pain, so we came with this: a backup is automatically created before each update. After the update, the system checks the website and rolls back automatically if something’s wrong. And the best part is that you can set these updates to run at 3am, when the website traffic as its lowest.<br />
<a href="https://managewp.com/features/safe-updates" title="Safe Updates" rel="nofollow ugc">Read more</a>.</p>
<h4>Client Report</h4>
<p>Summarize your hard work in a professional looking report and send it to your clients to showcase your work. The free Client Report includes basic customization and on-demand reports. The premium Client Report lets you white label and automate your reports. <a href="https://managewp.com/features/client-report" title="Client Report" rel="nofollow ugc">Read more</a></p>
<h4>Performance and Security Checks</h4>
<p>Slow or infected websites are bad for business. Luckily, you can now keep tabs on your websites with regular performance & security checks. The free <a href="https://managewp.com/features/security-check" title="security check" rel="nofollow ugc">Security Check</a> & <a href="https://managewp.com/features/performance-scan" title="performance check" rel="nofollow ugc">Performance Check</a> come with fully functional checks and logging. Premium versions let you fully automate the checks, and get an SMS or an email if something’s wrong.</p>
<h4>Google Analytics integration</h4>
<p>Connect multiple Google Analytics accounts, and keep track of all the important metrics from one place.  <a href="https://managewp.com/features/analytics" title="Google Analytics integration" rel="nofollow ugc">Read more</a></p>
<h4>Uptime Monitor (premium add-on)</h4>
<p>Be the first to know when your website is down with both email and SMS notifications, and get your website back online before anyone else notices. <a href="https://managewp.com/features/uptime-monitor" title="Uptime Monitor" rel="nofollow ugc">Read more</a></p>
<h4>Cloning & Migration (bundled with premium Backup add-on)</h4>
<p>What used to take you hours of work and nerves of steel is now a one-click operation. Pick a source website, pick a destination website, click Go. Within minutes, your website will be alive and kicking on a new server. Yeah, it’s that easy. <a href="https://managewp.com/features/clone" title="Cloning & migration" rel="nofollow ugc">Read more</a></p>
<h4>SEO Ranking (premium add-on)</h4>
<p>Be on top of your website rankings and figure out which keywords work best for you, as well as keeping on eye on your competitors. This way you will know how well you stack up against them. <a href="https://managewp.com/features/seo-ranking" title="SEO Ranking" rel="nofollow ugc">Read more</a></p>
<h4>White Label (premium add-on)</h4>
<p>Rename or completely hide the ManageWP Worker plugin. Clients don’t need to know what you are using to manage their websites. <a href="https://managewp.com/features/white-label" title="White Label" rel="nofollow ugc">Read more</a></p>
<h4>Is This All?</h4>
<p>No way! We’ve got a bunch of other awesome features, both free and premium, you can check out on our <a href="https://managewp.com/features" title="ManageWP Features" rel="nofollow ugc">ManageWP features page</a></p>
<p>Check out the <a href="https://vimeo.com/220647227" rel="nofollow ugc">ManageWP promo video</a>.</p>
<p><iframe loading="lazy" title="Manage Explainer Video" src="https://player.vimeo.com/video/220647227?dnt=1&app_id=122963" width="750" height="422" frameborder="0" allow="autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe></p>
<h3>License</h3>
<p>This file is part of ManageWP Worker.</p>
<p>ManageWP Worker is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.</p>
<p>ManageWP Worker is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.</p>
<p>You should have received a copy of the GNU General Public License along with ManageWP Worker. If not, see <a href="https://www.gnu.org/licenses/" rel="nofollow ugc">https://www.gnu.org/licenses/</a>.</p>


ManageWP Worker

Manage WP is a fantastic platform for managing thousands of WordPress websites in one place. As an Agency holder, I have to manage more than 50+ websites daily. Log in to every single site and make things dull and time-consuming. Using Manage WP helps me to manage all my WordPress sites from one place. The free version comes with lots of features. I love this platform. 

Saves my Time !!

This is a great plugin/service, been using it for years. I tried a self-hosted option once, and it was just too much hassle to keep the management software updated. ManageWP takes one more thing off my plate compared to self-hosted options, and gives me peace of mind. Keep up the great work!

fantastic


To be able to manage all my sites from one interface by client has simplified my life dramatically. The interface is intuitive. If you can figure out how to make WordPress work, you can use this. Thank you Godaddy for making this available. 


Well-reasoned UI/UX. This has simplified my life. Well done!


This is an amazing tool to manage multiple wordpress sites. Nice work team.


Amazing Tool

A great time saver for managing 100+ websites.

A great time saver!


Yes. This is it.



With 20+ Websites, it was really hard to manage all of them separately. Now you have everything in sight at all times.



Just wondering why the connection code is not directly in one of those boxes on the frontpage/dashboard and directly accessible from there!


Life saver

A better way to manage dozens of WordPress websites.

Strict CSP vs ManageWP Worker