Source evidence

content security policy

Security Headers · support · 2016-09-15T16:34:00+00:00

Security Headers plugin evidence original source source API

mixedsentiment

highseverity

0.76relevance

3replies

Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

5 / 16 rows with source links

31.2% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

11 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support

Amir resolved

Hi you don’t add content security policy to your headers? https://wordpress.org/plugins/wp-content-security-policy/ Thanks Amir I aim to do that in the next release. I am familiar with CSP, but I’ve not created a decent policy for my own WordPress site, let alone everyone else’s. The place you need it is mostly in the admin pages. The main take home is don’t start from here, decent CSP needs unsafe-inline, which probably means rewriting WordPress and all its plugins. This didn’t make 0.9. I’m still not convinced a meaningful CSP is workable with WordPress. Best I can imagine is some basic controls, and an easy way to add extra domains for images and scripts (and maybe fonts and styles). Probably better to focus on a modern blogging or CMS platform which avoids inline style, inline script, and JavaScript evaluation, or static site builders depending on the threat model. No problem man, thanks anyway for the update 🙂

Commercial Context

Opportunity

hosting operations and site health

Https site-health operations for keeping hosted WordPress sites healthy across caching, updates, backups, and support handoffs

Buyer: site owners, agencies, and maintenance teams

Wedge: monitor https health, updates, cache state, cron jobs, and maintenance exceptions

Proof Blocked card complete market

Analysis

heuristic-v1

Summary: content security policy: users show security pain that may indicate a product gap.

Evidence quote: content security policy Hi you don’t add content security policy to your headers?

Affected feature: form

security easy quality form

Plugin

API

Security Headers

3.0K active installs · 48.0K downloads · rating 100.0

hsts https nosniff tls

Comments

3 shown

SimonRWaters 2016-10-13T15:13:00+00:00

Thanks Amir I aim to do that in the next release. I am familiar with CSP, but I’ve not created a decent policy for my own WordPress site, let alone everyone else’s. The place you need it is mostly in the admin pages. The main take home is don’t start from here, decent CSP needs unsafe-inline, which probably means rewriting WordPress and all its plugins.

SimonRWaters 2017-02-18T00:12:00+00:00

This didn’t make 0.9. I’m still not convinced a meaningful CSP is workable with WordPress. Best I can imagine is some basic controls, and an easy way to add extra domains for images and scripts (and maybe fonts and styles). Probably better to focus on a modern blogging or CMS platform which avoids inline style, inline script, and JavaScript evaluation, or static site builders depending on the threat model.

Amir 2017-02-18T08:48:00+00:00

No problem man, thanks anyway for the update 🙂