Dylan

Content Security Policy (CSP) is a W3C guideline to prevent cross-site scripting (XSS) and related attacks. XSS allows other people to run scripts on your site, making it no 
longer your application running on your site, and opens your whole domain to attack due to “Same-Origin Policy” – XSS anywhere on your domain is XSS everywhere on your domain. (see https://www.youtube.com/watch?v=WljJ5guzcLs)
CSP tells your browser to push least-privilege environment on your application, allowing the client to only use resources from trusted domains and block all resources from anywhere else.
Adding CSP to your site will protect your visitors from:
<ul>
<li>Cross-site scripting (XSS) attacks</li>
<li>Adware and Spyware while on your site</li>
</ul>
This plugin will help you set your CSP settings and will add them to the page the visitor requested. Policy violations will be logged in a database table which can be viewed via an admin page that supplies all the violations, along with counts. Buttons easily allow you to add the sites to your headers or to ignore them.
This plugin also allows you to ignore sites that repeatedly violate your policies. For example, some tracking images will show as violating your policies, but you still don’t want them to run, therefore you can block the site from showing up in your logs – note, however, that the browser will still call your server and your server will still spend resources processing the call.
In addition, this plugin can help you to get on the HSTS Preload list – See https://hstspreload.org/ for details.
<h4>CSP Directives</h4>
CSP allows you to control where your visitors’ browser can run code from.
The W3C specification allows for the following directives:
<ul>
<li>
default-src 
The default-src is the default policy for loading content. If another setting is blank then this setting will be used.
</li>
<li>
script-src 
Defines valid sources of JavaScript.
</li>
<li>
style-src 
Defines valid sources of stylesheets.
</li>
<li>
img-src 
Defines valid sources of images.
</li>
<li>
connect-src 
Applies to XMLHttpRequest (AJAX), WebSocket or EventSource.
</li>
<li>
manifest-src 
Specifies which manifest can be applied to the resource
</li>
<li>
worker-src 
Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.
</li>
<li>
font-src 
Defines valid sources of fonts.
</li>
<li>
object-src 
Defines valid sources of plugins. Stops your site becoming the source of drive-by attacks.
</li>
<li>
media-src 
Defines valid sources of audio and video.
</li>
<li>
base-uri 
Limit the values that can be used in the entry.
</li>
<li>
frame-src 
Defines valid sources for loading frames.
</li>
<li>
sandbox 
Enables a sandbox for the requested resource similar to the iframe sandbox attribute.
</li>
<li>
form-action 
The form-action restricts which URLs can be used as the action of HTML form elements.
</li>
<li>
frame-ancestors 
Whether to allow embedding the resource using a frame, iframe, object, embed, etc. in non-HTML resources.
</li>
<li>
plugin-types 
Restricts the set of plugins that can be invoked by limiting the types of resources that can be embedded.
</li>
<li>
report-uri 
URL to post information on violations of the policies you set.
</li>
<li>
require-sri-for 
Require integrity check for scripts and/or styles.
</li>
</ul>
<h4>CSP Entry Syntax</h4>
Note – with version 3 of the CSP specification there has been a move to ‘strict-dynamic’ – see the Upgrade Notice section for more information.
Each directive can take one or more of the following values:
<ul>
<li>
* 
Allows loading resources from any source.
</li>
<li>
‘none’ 
Blocks loading resources from all sources. The single quotes are required.
</li>
<li>
‘self’ 
Refers to your own host. The single quotes are required.
</li>
<li>
‘unsafe-inline’ 
Allows inline elements, such as functions in script tags, onclicks, etc. The single quotes are required.
</li>
<li>
‘unsafe-eval’ 
Allows unsafe dynamic code evaluation such as JavaScript eval(). The single quotes are required.
</li>
<li>
‘strict-dynamic’ 
The trust explicitly given to a script present in the markup, by accompanying it with a nonce or a hash, shall be propagated to all the scripts loaded by that root script. The single quotes are required.
</li>
<li>
‘sha-AAAAAAAAA’ 
For scripts and styles that can’t take a nonce the browser will tell you a ‘sha-‘ value you can use. The single quotes are required.
</li>
<li>
‘nonce-AAAAAAAAA’ 
The trust nonce value – this value is automatically generated per page refresh and should not be entered by the user. The single quotes are required.
</li>
<li>
data: 
Allow loading resources from data scheme – usually inline images. This is insecure; an attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts.
</li>
<li>
mediastream: 
Allows mediastream: URIs to be used as a content source.
</li>
<li>
filesystem: 
Allow loading resource from file system.
</li>
<li>
https: 
Only allows loading resources from HTTPS: on any domain. This can be used to block insecure requests.
</li>
<li>
www.example.com 
Allow loading resources from this domain, using any scheme (http/https)
</li>
<li>
*.example.com 
Allow loading resourcs from any subdomain under example.com, using any scheme (http/https)
</li>
<li>
http://www.example.com 
Allows loading resources from this domain using this scheme.
</li>
<li>
/path/to/file/ 
Allows loading any file from this path on this domain.
</li>
<li>
/path/to/file/thefile 
Allows loading this one file on this domain.
</li>
</ul>
<h4>Security Headers</h4>
In addition to the CSP headers, there are other security headers supported, including:
<ul>
<li>
Expect-CT 
Instructs user agents (browsers) to expect valid Signed Certificate Timestamps (SCTs) to be served.
</li>
<li>
Strict Transport Security 
The HTTP Strict-Transport-Security response header (HSTS) lets a web site tell browsers that it should only be accessed using HTTPS, instead of using HTTP.
</li>
<li>
X-Frame-Options 
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object> . Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.
</li>
<li>
X-XSS-Protection 
The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. Although these protections are largely unnecessary in modern browsers when sites implement a strong Content-Security-Policy that disables the use of inline JavaScript (‘unsafe-inline’), they can still provide protections for users of older web browsers that don’t yet support CSP.
</li>
<li>
X-Content-Type-Options 
The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a way to say that the webmasters knew what they were doing.
</li>
<li>
Referrer-Policy 
The Referrer-Policy HTTP header governs which referrer information, sent in the Referer header, should be included with requests made.
</li>
</ul>
<h3>Written By</h3>
This plugin was written by Dylan Downhill, CDO of <a href="https://www.elixirinteractive.com/" rel="nofollow ugc">Elixir Interactive</a> .

WP Content Security Plugin

This plugin was implemented on one of our sites as we needed a CSP. None of the team really knew what one was until I was recommended this plugin. 

It's great. Really great, and highly recommended in helping you get a handle on CSP's

Very Easy Setup, great for understanding CSPS

Block XSS vulnerabilities by adding a Content Security Policy header, plugin receives violations to easily maintain the security policy.

bluetriangle

SeaSP Community Edition is an automated Content Security Policy Manager. SeaSP allows you to create, configure, manage, and deploy a Content Security Policy for your site.
The WordPress SeaSP Community Edition plugin catalogs the domains that appear on your site. Categorize and filter out unwanted domains. Add a layer of WordPress security site from Magecart and other cross-site scripting attacks to keep your WordPress site safe.
SeaSP installs a strict non-blocking CSP to collect violation data and provide a violation report. Violation data flows into the WordPress database as a PHP option within the plugin options schema. Violations can be approved by domains and categorized by directives (CSS, fonts, images, JS, etc.). You can also approve base domains and subdomains. The SeaSP UI helps users by explaining what each directive does, and how to use them to create a CSP.
After configuring the domain and directive settings switch the CSP to blocking mode. Once the CSP goes into blocking mode, the site’s protected from any unrecognized code. SeaSP Community Edition helps secure your site.
<h3>Upgrade Notice for 1.4 only</h3>
<ul>
<li>When you install this version you will need to rebuild your CSP</li>
</ul>
<h3>Usage</h3>
Once installed, a strict non-blocking report-only CSP is implemented on your site. Visit each page of your site to collect CSP violations. 
Visit the Current Violations page of the plugin to review domains that have violated a directive in the CSP. 
Review each of the domains carefully and check for misspellings of common domains like adobee.com instead of adobe.com as this is a common way hackers inject content into your site. 
If you feel confident that the domain belongs on your site and it should be serving the file type stated, click the toggle to approve the domain to include it in the CSP. 
If you want to allow subdomains of that domain to be able to serve that type of content, click the Manage subdomains button to view the subdomains. 
After this process, you might still see CSP violations regarding inline scripts, inline styles, blobs, or data. 
To allow these this type of content in the community version you must navigate to the Directive Settings page, find the offending directive, then toggle the appropriate option. 
For convenience, each option has a tooltip explaining what it allows in your CSP.
<h3>Walk Through</h3>
A walk through video can be found on YouTube <a href="https://youtu.be/XdJNh6LEKJw" rel="nofollow ugc">here</a>.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/XdJNh6LEKJw?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h3>Contributing</h3>
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change. 
This project has been tested on WordPress up to version 5.8 on both single and multi-site instances. 
The project can be found on <a href="https://github.com/blue-triangle-tech/sea-sp-community-edition" rel="nofollow ugc">github</a>. 
This project is sponsored by <a href="www.bluetriangle.com" rel="nofollow ugc">Blue Triangle</a>.
<h3>Third Party Libraries</h3>
We use <a href="https://getbootstrap.com/" rel="nofollow ugc">Bootstrap</a> for the UI of our plugin to make the interface clean and simple. 
Bootstraps license can be found <a href="https://github.com/twbs/bootstrap/blob/main/LICENSE" rel="nofollow ugc">here</a>
We use <a href="https://www.bootstraptoggle.com/" rel="nofollow ugc">bootstrap toggle</a> because simple check boxes can be confusing and we wanted our CSP mangers UI to feel easy. This code was developed for The New York Times by <a href="https://github.com/minhur" rel="nofollow ugc">Min Hur</a> and is licensed under <a href="https://opensource.org/licenses/MIT" rel="nofollow ugc">MIT</a>
<h3>License</h3>
<a href="https://choosealicense.com/licenses/gpl-3.0/" rel="nofollow ugc">GNU</a>
<h3>Opt In usage data collection</h3>
As of version 1.5 users will be able to opt-in for data collection to help us determine how many people are using our plugin and what features we should be working on in future version. This can be managed in the Usage Data Settings page. We collect and send the following data: 
1. wordpress version 
2. wordpress debug mode 
3. wordpress multisite 
4. the base url that the plugin is on ex; www.bluetriangle.com 
This data is only accessible to the Blue Triangle organization and will be used to determine our user base and feature planning.

SeaSP Community Edition

SeaSP Community Edition is an automated Content Security Policy Manager. SeaSP allows you to create, configure, manage, and deploy a Content Security  …

WP Content Security Plugin vs SeaSP Community Edition