hash, strict-dynamic, nonce, report-sample, report-to directives

Primary CSP Info: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

nonce and hash do not have directives in the CSP header itself.

For implementing safe hashes and/or nonces for scripts, you would have to generate them yourself and put them in the script-src directive: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#whitelisting_external_scripts_using_hashes

strict-dynamic is also not a directive, and you would need to generate and implement it inside the script-src directive: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#strict-dynamic

As for report-to… I thought about implementing that when I first started building this plugin, however, since the plugin is more along the lines of implementation for the headers themselves, I decided against bothering with the report only feature, as I would then need to likely hide the rest of the configuration since it would be pretty pointless in keeping it ??

It’s also not supported in Firefox or Safari… so… I wouldn’t build it in until it gets full coverage: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to#browser_compatibility

Hi,
Thanks for your response.
Nonce could be generated on the fly and automatically added into scripts/styles through a str_replace().
That’s actually what I do using a function.php ??

Perfectly clear for the rest.

@psykonevro report-to is being released shortly