Strict CSP

function my_theme_supports_js() {
    wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅
}
add_action( 'wp_footer', 'my_theme_supports_js' );

So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including wp_enqueue_script(), wp_add_inline_script(), wp_localize_script(), wp_print_script_tag(), wp_print_inline_script_tag(), and wp_enqueue_script_module(). Otherwise, a script’s execution will be blocked and an error will appear in the console, for example:

Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list.

This also blocks scripts inside of event handler attributes, such as onclick, onchange, onsubmit, and onload. As noted on MDN:

Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies.

This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the nonce attribute added.

1. Visit Plugins > Add New in the WordPress Admin.
2. Search for Strict CSP.
3. Install and activate the Strict CSP plugin.
4. Log out of WordPress and log back in with the “Remember Me” checkbox checked.

You may also install and update via Git Updater using the plugin’s GitHub URL.

Manual

1. Download the plugin ZIP either from WordPress.org or from GitHub. Alternatively, if you have a local clone of the repo, run npm run plugin-zip.
2. Visit Plugins > Add New Plugin in the WordPress Admin.
3. Click Upload Plugin.
4. Select the strict-csp.zip file on your system from step 1 and click Install Now.
5. Click the Activate Plugin button.

• Use wp_generate_password() to create CSP nonce instead of using wp_create_nonce(). Props kasparsd. (#13)

0.3.1

• Update required PHP version to 7.2 instead of 8.1.

0.3.0

• Add nonce attributes to scripts added by embeds.

0.2.0

• Disable Strict CSP from Site Editor.
• Restrict policy to frontend and login screen.

0.1.0

• Initial release.