Home / server / Questions / 814706
In Process
srkiNZ84
Asked: 2016-11-14 19:00:55 +0800 CST

How to determine CSP for Wordpress

  • 772

I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header:

Header always set Content-Security-Policy "default-src 'self' https://blogname.com:*"

However, when I set this, the "edit/create Post" page in particular throws a bunch of errors which look to be related to:

  • 3rd party fonts it needs to download
  • Other AJAX requests for javascript (e.g. for the editor)
  • Other stuff, probably related to plugins

How can I easily identify all the 3rd party URL's that are needed for Wordpress and all of its plugins, so that I can add them to the CSP header?

wordpress apache2 content-security-policy

2 Answers

  1. Use the header Content-Security-Policy-Report-Only first (Content-Security-Policy-Report-Only). This will allow you to test the policy and tune it. It works the same as the "regular" CSP header, except policy violations are not blocked, just reported.

    You can use the free service https://report-uri.io/ to receive the reports.

    • 3

  2. This policy worked for me:

    Header always set Content-Security-Policy "default-src 'unsafe-inline' 'unsafe-eval' 'self'; font-src 'self' data: https://fonts.gstatic.com:443; img-src 'self' data: https://secure.gravatar.com:443; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com:443"

    The twitter example from:

    https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet#Mixed_Content_Policy

    was particularly helpful as a starting point.

    • -1