Replace 'unsafe-inline' scripts with nonces or hashes on WordPress

Why it matters

With 'unsafe-inline' any script an attacker manages to inject into the page runs, which cancels most of what a CSP protects. Nonces or hashes let only the inline scripts you wrote run.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. WordPress core, themes and plugins print many inline scripts, and plugins often echo their own, so a nonce-based policy is a project. The wp_inline_script_attributes and wp_script_attributes filters add attributes only to scripts printed through WordPress's script functions.
2. Stage 1: with a security-headers plugin that supports nonces, or custom code using those filters, send the nonce policy as report-only and see what is still blocked.
3. Stage 2: enforce once the reports are clean. Full-page caching serves one nonce to every visitor, so exclude those pages from caching or keep 'unsafe-inline' there.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Remove 'unsafe-eval' from script-src
• Remove wildcard sources from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax