WordPress Content Security Policy Plugin
Script Sentinel is a free WordPress CSP plugin that starts a bounded Chrome scan of up to 10 reached public pages and generates a Content Security Policy for administrator review. Scanning does not change your headers; a complete result stays inactive until an administrator explicitly chooses to activate it.
Scan public WordPress pages in Chrome
Start from the canonical home page and follow eligible same-origin links while the hosted scanner observes scripts, styles, images, fonts, frames, connections, and supported inline-code evidence. A scan can visit the home page plus up to nine more public pages and may reach fewer.
Review a generated WordPress CSP
The WordPress CSP generator returns a policy candidate, score, page count, and warnings in Tools > Script Sentinel. Review the sources and copy the policy if needed. Partial or header-unsafe results cannot be activated.
Activate and verify explicitly
On a staging site, an administrator can separately activate a complete candidate, check its exact anonymous public GET and HEAD delivery, deactivate it, or restore one prior plugin-owned state.
How to add a Content Security Policy to WordPress
- Install the free plugin. Add Script Sentinel from WordPress.org, activate it, and open Tools > Script Sentinel.
- Read the service notice. A scan begins only after an administrator agrees to send the public site URL and scan options to Script Sentinel. No WordPress login cookies, administrator credentials, or screenshots are sent.
- Run the WordPress CSP scanner. Choose Scan up to 10 pages. The site must have a canonical public HTTPS URL and expose the temporary REST proof route.
- Review the candidate. Check the generated directives, observed sources, score, and warnings. A bounded crawl is a starting point, not proof that every page or application state was covered.
- Activate on staging. If the complete result matches the resources you intend to trust, explicitly activate that exact candidate and confirm the enforcement warning.
- Verify and exercise real flows. Inspect the anonymous public response, purge page and CDN caches after changes, and test representative consent, ecommerce, membership, authenticated, and interactive flows before relying on enforcement.
What the WordPress CSP scan can see
The free scan observes only eligible public pages and the states reached during ordinary browser loading plus a bounded scroll-and-settle cycle. It does not sign in, scan wp-admin, intentionally submit forms, or inspect private, password-protected, or logged-in content.
The hosted endpoint currently accepts at most one valid scan per canonical site during a rolling 60-minute period. This scan limit does not expire or disable local CSP controls.
Where the plugin can set CSP
The free deployment adapter emits one enforced Content-Security-Policy header on eligible logged-out public 2xx HTML or XHTML GET and HEAD responses generated through WordPress.
It does not add a report-only policy, collect violation reports, or manage a general security-header pack. Admin, login, REST, AJAX, feed, preview, redirect, error, and non-HTML responses are excluded.
Deactivate or restore the prior CSP
A failed public delivery check remains visible and does not silently change the local deployment. Administrators can verify again, deactivate the plugin-owned CSP, restore one prior state, or use the documented emergency bypass while correcting a policy.
Only one prior plugin-owned state is retained, so each later activate, deactivate, or restore action replaces that rollback point.
Check WordPress, host, cache, and CDN headers
Script Sentinel suppresses its header when WordPress or PHP exposes another enforced CSP. A host, web server, reverse proxy, page cache, or CDN can still add or replace headers after PHP, outside the plugin's reliable view. Purge relevant caches and inspect the final uncached public response before treating local status as public delivery.
Exact verification covers one anonymous canonical-home GET and HEAD check. It does not prove delivery across every page, cache variant, geography, device, personalized state, or future response.
WordPress CSP Plugin FAQ
Is the WordPress CSP plugin free?
Yes. Free manual scans, the latest locally stored result, and explicit local CSP activation, verification, deactivation, and prior-state restore do not require an account or paid plan. Free mode has no recurring scans or run history.
Does a scan automatically change my CSP?
No. Scanning and activation are separate administrator actions. A complete candidate remains inactive until an administrator reviews it, chooses Activate latest CSP, and confirms the warning.
Can a generated CSP break a WordPress site?
Any enforced CSP can block resources or flows that its directives do not allow. Test on staging, review every intended source, exercise representative states, and keep a recovery path. Script Sentinel does not promise that a bounded scan found every dependency.
Why can public verification differ from WordPress?
Stored local state is not the same as the final response delivered to a visitor. Request exclusions, redirects, competing policies, a web server, proxy, cache, CDN, or network failure can change what the verification request receives.
Start with the free WordPress CSP plugin
Install from the official directory, scan public pages, and keep every deployment decision under explicit administrator control.
Content Security Policy resources for WordPress
Use the web scanner for an editable candidate, learn the directive model, and test representative application flows before enforcement.