Content Security Policy

Hello! Yes this is possible. The headers generated by the plugin can be filtered just before they are sent by attaching a filtering function to the addh_headers filter. Sample code:

function addh_add_custom_headers( $headers ) {
    $headers[] = 'X-Custom-Header-1: foo-bar';
    $headers[] = 'X-Custom-Header-2: ...';
    return $headers;
}
add_filter( 'addh_headers', 'addh_add_custom_headers', 10, 1 );

This code can be added in the functions.php file of the theme or in a plugin with customizations.

Hope it helps.

George

Good news!

I’m trying to exclude CSP header on iOS Safari and can’t do this with .htaccess correctly. Will try using your plugin. Thank you!

Not sure if exclusion is possible. It depends on which piece of software generates the CSP header. Possibly this has to be done at the web server level.

George

Good day,

How this filter work after new release?

I’ve got only:

1               Vary: User-Agent
^               ^
header name     attribute

function addh_add_custom_headers( $headers ) {
   //variabels removed, just for example
   $headers[] = "Content-Security-Policy: $default_src $script_src $object_src $style_src $img_src $media_src $frame_src $font_src $connect_src $report";
    $headers[] = "Vary: User-Agent";
    return $headers;
}
add_filter( 'addh_headers', 'addh_add_custom_headers', 10, 1 );

Thank you in advance!

Okay, I’ve found by myself what I need to do.

function addh_add_custom_headers( $headers ) {
   //variabels removed, just for example
   $headers['Content-Security-Policy'] = "$default_src $script_src $object_src $style_src $img_src $media_src $frame_src $font_src $connect_src $report";
    $headers['Vary'] = "User-Agent";
    return $headers;
}
add_filter( 'addh_headers', 'addh_add_custom_headers', 10, 1 );

Pleas, update you FAQ “Add custom headers”

Have a nice day!

Hi @slams,

Fixed the docs. I’m sorry about that.

Glad you have sorted it out. This is the way to add headers in 2.X.

Kind Regards,
George