Title: Strict CSP
Author: Weston Ruter
Published: <strong>2025 年 8 月 10 日</strong>
Last modified: 2026 年 5 月 19 日

---

搜尋外掛

![](https://ps.w.org/strict-csp/assets/banner-772x250.png?rev=3342167)

![](https://ps.w.org/strict-csp/assets/icon.svg?rev=3342167)

# Strict CSP

 由 [Weston Ruter](https://profiles.wordpress.org/westonruter/) 開發

[下載](https://downloads.wordpress.org/plugin/strict-csp.0.3.2.zip)

 * [詳細資料](https://tw.wordpress.org/plugins/strict-csp/#description)
 * [使用者評論](https://tw.wordpress.org/plugins/strict-csp/#reviews)
 *  [安裝方式](https://tw.wordpress.org/plugins/strict-csp/#installation)
 * [開發資訊](https://tw.wordpress.org/plugins/strict-csp/#developers)

 [技術支援](https://wordpress.org/support/plugin/strict-csp/)

## 外掛說明

This plugin enforces a [Strict Content Security Policy](https://web.dev/articles/strict-csp)(
CSP) on the frontend and login screen. This helps mitigate [cross-site scripting](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS)(
XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see [#59446](https://core.trac.wordpress.org/ticket/59446)).

In [#58664](https://core.trac.wordpress.org/ticket/58664), the manual construction
of script tags was eliminated from `WP_Scripts` and inline scripts on frontend/login
screen, thanks to the helper functions which had previously been introduced in [#39941](https://core.trac.wordpress.org/ticket/39941).
This made it possible to apply Strict CSP, as long as themes and plugins are not
directly printing `<script>` tags. Some bundled WordPress core themes [still do this](https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+path%3A%2F%5Esrc%5C%2Fwp-content%5C%2Fthemes%5C%2F%2F+%2F%3Cscript%5B%5E%3E%5D*%3E%2F&type=code)
incorrectly (which has been reported in Trac as [#63806](https://core.trac.wordpress.org/ticket/63806)).
For example, do not do this:

    ```
    function my_theme_supports_js() {
        echo '<script>document.body.classList.remove("no-js");</script>'; // ❌
    }
    add_action( 'wp_footer', 'my_theme_supports_js' );
    ```

Instead, do this:

    ```
    function my_theme_supports_js() {
        wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅
    }
    add_action( 'wp_footer', 'my_theme_supports_js' );
    ```

So in order for scripts to execute, they must be printed using the relevant APIs
in WordPress for adding scripts, including [`wp_enqueue_script()`](https://developer.wordpress.org/reference/functions/wp_enqueue_script/),
[`wp_add_inline_script()`](https://developer.wordpress.org/reference/functions/wp_add_inline_script/),
[`wp_localize_script()`](https://developer.wordpress.org/reference/functions/wp_localize_script/),
[`wp_print_script_tag()`](https://developer.wordpress.org/reference/functions/wp_print_script_tag/),
[`wp_print_inline_script_tag()`](https://developer.wordpress.org/reference/functions/wp_print_inline_script_tag/),
and [`wp_enqueue_script_module()`](https://developer.wordpress.org/reference/functions/wp_enqueue_script_module/).
Otherwise, a script’s execution will be blocked and an error will appear in the 
console, for example:

> Refused to execute inline script because it violates the following Content Security
> Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’
> https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce 
> value is present in the source list.

This also blocks scripts inside of [event handler attributes](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes#event_handler_attributes),
such as `onclick`, `onchange`, `onsubmit`, and `onload`. As noted on MDN:

> Warning: The use of event handler content attributes is discouraged. The mix of
> HTML and JavaScript often produces unmaintainable code, and the execution of event
> handler attributes may also be blocked by content security policies.

This plugin also ensures that scripts added to the page from embeds (e.g. Tweets)
also get the `nonce` attribute added.

## 安裝方式

#### Automatic

 1. Visit **Plugins > Add New** in the WordPress Admin.
 2. Search for **Strict CSP**.
 3. Install and activate the **Strict CSP** plugin.
 4. Log out of WordPress and log back in with the “Remember Me” checkbox checked.

You may also install and update via [Git Updater](https://git-updater.com/) using
the [plugin’s GitHub URL](https://github.com/westonruter/strict-csp).

#### Manual

 1. Download the plugin ZIP either [from WordPress.org](https://downloads.wordpress.org/plugin/strict-csp.zip)
    or [from GitHub](https://github.com/westonruter/strict-csp/archive/refs/heads/main.zip).
    Alternatively, if you have a local clone of the repo, run `npm run plugin-zip`.
 2. Visit **Plugins > Add New Plugin** in the WordPress Admin.
 3. Click **Upload Plugin**.
 4. Select the `strict-csp.zip` file on your system from step 1 and click **Install
    Now**.
 5. Click the **Activate Plugin** button.

## 使用者評論

這個外掛目前沒有任何使用者評論。

## 參與者及開發者

以下人員參與了開源軟體〈Strict CSP〉的開發相關工作。

參與者

 *   [ Weston Ruter ](https://profiles.wordpress.org/westonruter/)

〈Strict CSP〉外掛目前已有 1 個本地化語言版本。 感謝[全部譯者](https://translate.wordpress.org/projects/wp-plugins/strict-csp/contributors)
為這個外掛做出的貢獻。

[將〈Strict CSP〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/strict-csp)

### 對開發相關資訊感興趣？

任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/strict-csp/)、
查看 [SVN 存放庫](https://plugins.svn.wordpress.org/strict-csp/)，或透過 [RSS](https://plugins.trac.wordpress.org/log/strict-csp/?limit=100&mode=stop_on_copy&format=rss)
訂閱[開發記錄](https://plugins.trac.wordpress.org/log/strict-csp/)。

## 變更記錄

#### 0.3.2

 * Use `wp_generate_password()` to create CSP nonce instead of using `wp_create_nonce()`.
   Props [kasparsd](https://profiles.wordpress.org/kasparsd/). ([#13](https://github.com/westonruter/strict-csp/pull/13))

#### 0.3.1

 * Update required PHP version to 7.2 instead of 8.1.

#### 0.3.0

 * Add `nonce` attributes to scripts added by embeds.

#### 0.2.0

 * Disable Strict CSP from Site Editor.
 * Restrict policy to frontend and login screen.

#### 0.1.0

 * Initial release.

## 社群版外掛

這個外掛由社群人員開發及提供技術支援。 [參與這個外掛專案](https://github.com/westonruter/strict-csp)

## 中繼資料

 *  版本 **0.3.2**
 *  最後更新 **4 個月前**
 *  啟用安裝數 **50+**
 *  WordPress 版本需求 ** 6.4 或更新版本 **
 *  已測試相容的 WordPress 版本 **7.0.4**
 *  PHP 版本需求 ** 7.2 或更新版本 **
 *  語言
 * [English (US)](https://wordpress.org/plugins/strict-csp/) 及 [German](https://de.wordpress.org/plugins/strict-csp/).
 *  [將這個外掛本地化為你的母語版本](https://translate.wordpress.org/projects/wp-plugins/strict-csp)
 * 標籤:
 * [security](https://tw.wordpress.org/plugins/tags/security/)
 *  [進階檢視](https://tw.wordpress.org/plugins/strict-csp/advanced/)

## 評分

這個項目尚無任何評論記錄。

[撰寫評分](https://wordpress.org/support/plugin/strict-csp/reviews/#new-post)

[查看全部使用者評論](https://wordpress.org/support/plugin/strict-csp/reviews/)

## 參與者

 *   [ Weston Ruter ](https://profiles.wordpress.org/westonruter/)

## 技術支援

使用者可在技術支援論壇提出意見反應或使用問題。

 [檢視技術支援論壇](https://wordpress.org/support/plugin/strict-csp/)