Restrict where scripts can load from on WordPress
Why it matters
The policy sets neither script-src nor default-src, so it does nothing against injected scripts, the main thing a CSP is for. Add a script-src that lists only your own origin and the services you use, or that uses nonces.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: in your security-headers plugin or at the server or CDN, add script-src 'self' plus the script hosts your theme and plugins use, in report-only mode.
- Stage 2: enforce it. WordPress prints inline scripts, so a first enforced version may need 'unsafe-inline' in script-src until nonces are in place.
Related
- Reported by the Content-Security-Policy check
- Add a Content-Security-Policy
- Enforce the report-only Content-Security-Policy
- Send the Content-Security-Policy as an HTTP header
- Replace 'unsafe-inline' scripts with nonces or hashes
- Remove 'unsafe-eval' from script-src
- Remove wildcard sources from script-src
- Set object-src to 'none'
- Add base-uri to the Content-Security-Policy
- Reduce reliance on inline styles
- Fix the Content-Security-Policy syntax
Scan your domain to see whether this applies to you.