هذه الإضافة لم يتم تحديثها وتجربتها لأكثر من 3 إصدارات ووردبريس رئيسية. قد لا تكون خاضعة للصيانة أو تقدم الدعم والمساعدة بالوقت الحالي وقد تكون بها مشاكل في التوافق عند إستخدامها مع إصدارات حديثة من ووردبريس.

CSP-ANTS&ST

الوصف

For a perfectly secured website, you have to avoid ‘unsafe-eval’ and ‘unsafe-inline’ in your content-security-policy header.
This plugin add nonces to script/style tags and add those nonces to the content-security-policy header, so your website will be more secure, even if there are other actions to perform in order to have a very strong protection.

Features

There are no settings, it’s a plug and play plugin.
This plugin automaticallly:
– add a nonce to each script and style tag and a sha256 hash to online events (onload / onclick)
– generate Content Security Policy header with all nonces and hashes + basics (base-uri ‘self’, google fonts, gravatar, maxcdn.bootstrapcdn…)

Tested / Works with no cache system, WP Rocket on Plesk (Nginx/Apache webserver) and Lscache (Openlitespeed/Litespeed webserver)
Should work elsewhere, just say me and I’ll add your setup to this list.

Requirements

  • WordPress 5.0 or higher.

التنصيب

  • Extract the zip file and just drop the contents in the wp-content/plugins/ directory of your WordPress installation or install it directly from your dashboard and then activate the plugin from Plugins page.
  • There’s not options page, simply install and activate.

الأسئلة المتكررّة

Is there something to do after install?

Yes, just activate it!

المراجعات

24 يوليو، 2023
I downloaded this plugin and modified it for my site. I would recommend doing that. The plugin hooks into the 'template_redirect' hook. At that point the source for the page has been generated by themes and plugins and is ready to be sent. The plugin looks through the generated source and makes nonces for all inline scripts and styles. It modifies the source so the inline scripts and styles have a nonce='some-nonce' statement in them. It creates a Content-Security-Policy which includes those nonces. However, each site has its own CSP needs, and so modifying the plugin to tailor the CSP to your site is not that difficult to do. That is what I have done.
8 سبتمبر، 2022
The plugin works as advertised however, it does not let you modify the CSP header resulting in a less than ideal CSP header. The header this plugin serves provides no protection against clickjacking and allows all external scripts.
14 يوليو، 2022
This is the most 'straight to the point' CSP tool that I've found. So far, so go.
إقرأ جميع المراجعات 4

المساهمون والمطوّرون

“CSP-ANTS&ST” هو برنامج مفتوح المصدر. وقد ساهم هؤلاء الأشخاص بالأسفل في هذه الإضافة.

المساهمون

ترجمة ”CSP-ANTS&ST“ إلى لغتك.

مُهتم بالتطوير؟

تصفّح الشفرة، تحقق من مستودع SVN، أو الاشتراك في سجل التطوير بواسطة RSS.

سجل التغييرات

1.0

  • Initial release