How to determine CSP for Wordpress Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern) Come Celebrate our 10 Year Anniversary!Protecting Wordpress Admin interface on an alternate portwordpress on clustered (replication) serversHow to restore a Wordpress blog?Problems with Wordpress on Rackspace Cloud ServerCentos iptables configuration for Wordpress and Gmail smtpRsync plugin to many local wordpress installs via script or cliWordpress High load average 18 and cpu 81% on a dedicated serverHow can I get Wordpress to function under a Debian LAMP stack?chmod 640 in wp-config.php with user:www-data gets white screen on WordPressApache2 Loadbalancer with sticky session only sticky for GET, not POST
Why not use the yoke to control yaw, as well as pitch and roll?
French equivalents of おしゃれは足元から (Every good outfit starts with the shoes)
Does the main washing effect of soap come from foam?
Is this Kuo-toa homebrew race balanced?
How to make triangles with rounded sides and corners? (squircle with 3 sides)
My mentor says to set image to Fine instead of RAW — how is this different from JPG?
Are there any irrational/transcendental numbers for which the distribution of decimal digits is not uniform?
How to ask rejected full-time candidates to apply to teach individual courses?
Did pre-Columbian Americans know the spherical shape of the Earth?
Russian equivalents of おしゃれは足元から (Every good outfit starts with the shoes)
Getting representations of the Lie group out of representations of its Lie algebra
Table formatting with tabularx?
How to infer difference of population proportion between two groups when proportion is small?
NIntegrate on a solution of a matrix ODE
Why are two-digit numbers in Jonathan Swift's "Gulliver's Travels" (1726) written in "German style"?
Did any compiler fully use 80-bit floating point?
Found this skink in my tomato plant bucket. Is he trapped? Or could he leave if he wanted?
Twin's vs. Twins'
Problem with display of presentation
First paper to introduce the "principal-agent problem"
What is "Lambda" in Heston's original paper on stochastic volatility models?
How do I say "this must not happen"?
Does the Rock Gnome trait Artificer's Lore apply when you aren't proficient in History?
Besides transaction validation, are there any other uses of the Script language in Bitcoin
How to determine CSP for Wordpress
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 23, 2019 at 23:30 UTC (7:30pm US/Eastern)
Come Celebrate our 10 Year Anniversary!Protecting Wordpress Admin interface on an alternate portwordpress on clustered (replication) serversHow to restore a Wordpress blog?Problems with Wordpress on Rackspace Cloud ServerCentos iptables configuration for Wordpress and Gmail smtpRsync plugin to many local wordpress installs via script or cliWordpress High load average 18 and cpu 81% on a dedicated serverHow can I get Wordpress to function under a Debian LAMP stack?chmod 640 in wp-config.php with user:www-data gets white screen on WordPressApache2 Loadbalancer with sticky session only sticky for GET, not POST
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header:
Header always set Content-Security-Policy "default-src 'self' https://blogname.com:*"
However, when I set this, the "edit/create Post" page in particular throws a bunch of errors which look to be related to:
- 3rd party fonts it needs to download
- Other AJAX requests for javascript (e.g. for the editor)
- Other stuff, probably related to plugins
How can I easily identify all the 3rd party URL's that are needed for Wordpress and all of its plugins, so that I can add them to the CSP header?
wordpress apache2 content-security-policy
asked Nov 14 '16 at 3:00
srkiNZ84srkiNZ84
188118
add a comment |
I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header:
Header always set Content-Security-Policy "default-src 'self' https://blogname.com:*"
However, when I set this, the "edit/create Post" page in particular throws a bunch of errors which look to be related to:
- 3rd party fonts it needs to download
- Other AJAX requests for javascript (e.g. for the editor)
- Other stuff, probably related to plugins
How can I easily identify all the 3rd party URL's that are needed for Wordpress and all of its plugins, so that I can add them to the CSP header?
wordpress apache2 content-security-policy
asked Nov 14 '16 at 3:00
srkiNZ84srkiNZ84
188118
2
Sounds like you're on the right tracks. Identify problematic resources, patch your CSP policy and reload until all errors are gone. Then, start again with firefox or chrome depending on which was first. I don't know of any shortcut here, can be redundant and quite painful at first, ... Also consider wordpress updates may involve breaking changes.
– SYN
Nov 14 '16 at 3:06
add a comment |
I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header:
Header always set Content-Security-Policy "default-src 'self' https://blogname.com:*"
However, when I set this, the "edit/create Post" page in particular throws a bunch of errors which look to be related to:
- 3rd party fonts it needs to download
- Other AJAX requests for javascript (e.g. for the editor)
- Other stuff, probably related to plugins
How can I easily identify all the 3rd party URL's that are needed for Wordpress and all of its plugins, so that I can add them to the CSP header?
wordpress apache2 content-security-policy
asked Nov 14 '16 at 3:00
srkiNZ84srkiNZ84
188118
I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header:
Header always set Content-Security-Policy "default-src 'self' https://blogname.com:*"
However, when I set this, the "edit/create Post" page in particular throws a bunch of errors which look to be related to:
- 3rd party fonts it needs to download
- Other AJAX requests for javascript (e.g. for the editor)
- Other stuff, probably related to plugins
How can I easily identify all the 3rd party URL's that are needed for Wordpress and all of its plugins, so that I can add them to the CSP header?
wordpress apache2 content-security-policy
wordpress apache2 content-security-policy
asked Nov 14 '16 at 3:00
srkiNZ84srkiNZ84
188118
asked Nov 14 '16 at 3:00
srkiNZ84srkiNZ84
188118
asked Nov 14 '16 at 3:00
srkiNZ84srkiNZ84
188118
asked Nov 14 '16 at 3:00
srkiNZ84srkiNZ84
188118
asked Nov 14 '16 at 3:00
srkiNZ84srkiNZ84
188118
188118
2
Sounds like you're on the right tracks. Identify problematic resources, patch your CSP policy and reload until all errors are gone. Then, start again with firefox or chrome depending on which was first. I don't know of any shortcut here, can be redundant and quite painful at first, ... Also consider wordpress updates may involve breaking changes.
– SYN
Nov 14 '16 at 3:06
add a comment |
2
Sounds like you're on the right tracks. Identify problematic resources, patch your CSP policy and reload until all errors are gone. Then, start again with firefox or chrome depending on which was first. I don't know of any shortcut here, can be redundant and quite painful at first, ... Also consider wordpress updates may involve breaking changes.
– SYN
Nov 14 '16 at 3:06
2
2
Sounds like you're on the right tracks. Identify problematic resources, patch your CSP policy and reload until all errors are gone. Then, start again with firefox or chrome depending on which was first. I don't know of any shortcut here, can be redundant and quite painful at first, ... Also consider wordpress updates may involve breaking changes.
– SYN
Nov 14 '16 at 3:06
Sounds like you're on the right tracks. Identify problematic resources, patch your CSP policy and reload until all errors are gone. Then, start again with firefox or chrome depending on which was first. I don't know of any shortcut here, can be redundant and quite painful at first, ... Also consider wordpress updates may involve breaking changes.
– SYN
Nov 14 '16 at 3:06
add a comment |
2 Answers
2
active
oldest
votes
This policy worked for me:
Header always set Content-Security-Policy "default-src 'unsafe-inline' 'unsafe-eval' 'self'; font-src 'self' data: https://fonts.gstatic.com:443; img-src 'self' data: https://secure.gravatar.com:443; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com:443"
The twitter example from:
https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet#Mixed_Content_Policy
was particularly helpful as a starting point.
answered Nov 15 '16 at 1:10
srkiNZ84srkiNZ84
188118
add a comment |
Use the header Content-Security-Report-Only first. This will allow you to test the policy and tune it. It works the same as the "regular" CSP header, except policy violations are not blocked, just reported. You can use the free service https://report-uri.io/ to receive the reports.
answered Aug 5 '17 at 23:12
JulienJulien
76811021
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f814706%2fhow-to-determine-csp-for-wordpress%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
This policy worked for me:
Header always set Content-Security-Policy "default-src 'unsafe-inline' 'unsafe-eval' 'self'; font-src 'self' data: https://fonts.gstatic.com:443; img-src 'self' data: https://secure.gravatar.com:443; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com:443"
The twitter example from:
https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet#Mixed_Content_Policy
was particularly helpful as a starting point.
answered Nov 15 '16 at 1:10
srkiNZ84srkiNZ84
188118
add a comment |
This policy worked for me:
Header always set Content-Security-Policy "default-src 'unsafe-inline' 'unsafe-eval' 'self'; font-src 'self' data: https://fonts.gstatic.com:443; img-src 'self' data: https://secure.gravatar.com:443; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com:443"
The twitter example from:
https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet#Mixed_Content_Policy
was particularly helpful as a starting point.
answered Nov 15 '16 at 1:10
srkiNZ84srkiNZ84
188118
add a comment |
This policy worked for me:
Header always set Content-Security-Policy "default-src 'unsafe-inline' 'unsafe-eval' 'self'; font-src 'self' data: https://fonts.gstatic.com:443; img-src 'self' data: https://secure.gravatar.com:443; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com:443"
The twitter example from:
https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet#Mixed_Content_Policy
was particularly helpful as a starting point.
answered Nov 15 '16 at 1:10
srkiNZ84srkiNZ84
188118
This policy worked for me:
Header always set Content-Security-Policy "default-src 'unsafe-inline' 'unsafe-eval' 'self'; font-src 'self' data: https://fonts.gstatic.com:443; img-src 'self' data: https://secure.gravatar.com:443; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com:443"
The twitter example from:
https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet#Mixed_Content_Policy
was particularly helpful as a starting point.
answered Nov 15 '16 at 1:10
srkiNZ84srkiNZ84
188118
answered Nov 15 '16 at 1:10
srkiNZ84srkiNZ84
188118
answered Nov 15 '16 at 1:10
srkiNZ84srkiNZ84
188118
answered Nov 15 '16 at 1:10
srkiNZ84srkiNZ84
188118
188118
add a comment |
add a comment |
Use the header Content-Security-Report-Only first. This will allow you to test the policy and tune it. It works the same as the "regular" CSP header, except policy violations are not blocked, just reported. You can use the free service https://report-uri.io/ to receive the reports.
answered Aug 5 '17 at 23:12
JulienJulien
76811021
add a comment |
Use the header Content-Security-Report-Only first. This will allow you to test the policy and tune it. It works the same as the "regular" CSP header, except policy violations are not blocked, just reported. You can use the free service https://report-uri.io/ to receive the reports.
answered Aug 5 '17 at 23:12
JulienJulien
76811021
add a comment |
Use the header Content-Security-Report-Only first. This will allow you to test the policy and tune it. It works the same as the "regular" CSP header, except policy violations are not blocked, just reported. You can use the free service https://report-uri.io/ to receive the reports.
answered Aug 5 '17 at 23:12
JulienJulien
76811021
Use the header Content-Security-Report-Only first. This will allow you to test the policy and tune it. It works the same as the "regular" CSP header, except policy violations are not blocked, just reported. You can use the free service https://report-uri.io/ to receive the reports.
answered Aug 5 '17 at 23:12
JulienJulien
76811021
answered Aug 5 '17 at 23:12
JulienJulien
76811021
answered Aug 5 '17 at 23:12
JulienJulien
76811021
answered Aug 5 '17 at 23:12
JulienJulien
76811021
76811021
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f814706%2fhow-to-determine-csp-for-wordpress%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
Sounds like you're on the right tracks. Identify problematic resources, patch your CSP policy and reload until all errors are gone. Then, start again with firefox or chrome depending on which was first. I don't know of any shortcut here, can be redundant and quite painful at first, ... Also consider wordpress updates may involve breaking changes.
– SYN
Nov 14 '16 at 3:06