• Prevents Malicious Script Injection: Stops hackers from injecting harmful code
• Blocks Unauthorized Resource Loading:Only allows content from trusted sources
• Enhances Security Compliance: Meets requirements for regulated industries (healthcare, finance, etc.)
• Protects Client Data: Adds an extra layer of protection for sensitive information
• Improves Client Trust: Shows you take security seriously

1. Log into WordPress Admin
2. Navigate to Admin Settings (in the left sidebar)

3. Click on the Security tab
4. Look for the CSP Header field

1. In the CSP Header field, add your policy
2. Make sure “Report-Only Mode” is enabled (this is the default)
3. Save your changes

A secure default template is provided that works with most common services:

default-src 'self' *.gstatic.com;
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google-analytics.com google-analytics.com *.googletagmanager.com googletagmanager.com *.instagram.com *.cloudflare.com *.fareharbor.com fareharbor.com *.google.com *.youtube.com gstatic.com *.gstatic.com *.googleapis.com googleapis.com;
style-src 'self' 'unsafe-inline' *.googleapis.com *.gstatic.com;
img-src 'self' data:;
connect-src 'self' *.google-analytics.com *.googletagmanager.com *.instagram.com;
frame-src 'self' *.instagram.com *.facebook.com fareharbor.com *.fareharbor.com *.youtube.com youtube.com google.com *.google.com fareharboractivities.com;

This template allows:

• ✅ Self-hosted content
• ✅ Google services (Analytics, Tag Manager, Fonts, Maps)
• ✅ Social media embeds (Instagram, Facebook, YouTube)
• ✅ FareHarbor booking widgets
• ✅ Common CDNs and APIs

Testing is the most critical step! Visit every important page on the website and test all functionality.

Functionality Checklist:

• Homepage loads completely
• Contact forms submit successfully
• Booking calendar appears and functions
• Social media embeds display (Instagram, Facebook, YouTube)
• Google Analytics tracking works
• Any custom scripts or widgets function
• Mobile version works properly
• All navigation and menus work
• Image galleries and slideshows function
• Any third-party integrations work (chat widgets, etc.)

Check Browser Console

Example CSP Violation:

Content Security Policy: The page’s settings blocked the loading of a resource at https://example-widget.com/script.js because it violates the following directive: “script-src ‘self’ …

If you see CSP violations in the console:

1. Identify the blocked resource (the URL in the error message)
2. Add the domain to the appropriate directive in your CSP policy
3. Save and test again

Common Additions

For a chat widget from widget.com:

script-src 'self' 'unsafe-inline' ... widget.com;

For analytics from analytics-service.com:

connect-src 'self' ... analytics-service.com;

Only after all testing is complete and no violations remain:

1. Disable “Report-Only Mode”
2. Save your changes
3. Test one final time to ensure everything still works

Solution: Check if the form uses a third-party service. Add the service domain to script-src and connect-src.

Solution: Add the social media domains to frame-src. Common ones:

• Instagram: `*.instagram.com`
• Facebook: `*.facebook.com`
• YouTube: `*.youtube.com`

Solution: Ensure these are in your policy:

script-src ... *.google-analytics.com *.googletagmanager.com;
connect-src ... *.google-analytics.com *.googletagmanager.com;

Solution: Add font sources to font-src:

font-src 'self' fonts.googleapis.com fonts.gstatic.com;

Solution: Add image sources to img-src:

img-src 'self' data: *.amazonaws.com *.cloudfront.net;

✅ Do:

• Always test in report-only mode first
• Check the browser console for violations
• Test on multiple devices and browsers
• Document any custom additions you make
• Keep policies as restrictive as possible while maintaining functionality
• Regularly review and update policies

❌ Don’t:

• Enable enforcement mode without thorough testing
• Use `’unsafe-inline’` and `’unsafe-eval’` unless necessary
• Allow `*` (all domains) – be specific
• Ignore console violations
• Set up CSP on a live site without testing on staging first

Great Candidates

• Healthcare websites (HIPAA compliance)
• Financial services sites
• E-commerce platforms
• High-traffic websites
• Sites handling sensitive data
• Clients specifically requesting enhanced security

Consider Carefully:

• Sites with a lot of third-party integrations
• Websites with extensive custom code
• Sites where you don’t control all the plugins/widgets

When to Ask for Help:

If you encounter issues, please check each step below:

• Check the console first – it usually tells you exactly what’s blocked
• Start with the default template and add only what you need
• Test incrementally – add one service at a time
• Document your changes so you can revert if needed
• Ask for help if you’re unsure about a violation

CSP is a powerful security tool, but it requires careful implementation. When in doubt:

• Start conservative and add permissions as needed
• Always test thoroughly
• Keep detailed notes of what you’ve added and why
• Regular review policies to ensure they’re still appropriate

Remember: A broken CSP that blocks legitimate functionality is worse than no CSP at all. Take your time and test thoroughly!