where can i validate the CSP

Did you enable protection?

In your page, I see a CSP deployed, but it uses ‘unsafe-inline’, so it should have not been generated with this plugin.

The use of hashes for external styles has been removed since v. 1.1.2 because CSP does not allow the use of ‘hash-value’ to allow external styles.

My apologies, I had disabled the plugin protection. I have it enabled again now.

I have been building a policy manually, but the process with your plugin is much more helpful.

try again to create the CSP but it is still only upgrade-insecure-requests.

What can I do in this case?

can you post a screenshot of the settings’ page? It seems you didn’t enable any relevant directive, but I can’t be sure

Thank you for your reply.

These are all the settings options

I don’t know if there is a configuration error.
or if it is missing some kind of additional setting.

Thank you in advance for your support and answer.

Best regards

It is really weird. I will test this settings in a few days.

The strange thing is that you have disabled upgrade-insecure-request in No unsafe-inline but this is the only value deployed by your CSP.

Are you sure you are not deploying CSP via .haccess file or with another plugin?

If you are using any cache plugin, can you try to temporary disable it?

Yes, it is a strange case, because as you mention, the upgrade-insecure-request option is disabled, yet it is the only one that appears in the CSP inspection.
There is no CSP declared in the .htaccess and the only plugin I have tried to test on the site is this one. Additionally, it does not have any cache plugin.
I am trying to purge the cache from the server.

Hi @cfontecha, I have run some tests, but I cannot reproduce the problem. It seems that your CSP policy is not set by No unsafe-inline. Can you try to temporary disable any cache / security etc.. plugins to see what happens?

Can you read in No unsafe-inline log page if there is any error?

I’ve checked the log and can’t find anything.

I have similarly disabled security plugins and cleared the server cache to no avail.

However, when I activate Test policy with Content-Security-Policy-Report-Only, the policy appears in test mode.

In No unsafe-inline you “cannot” set both “Enable CSP Protection” ( = deploy a Content-Security-Policy header) and “Test policy with Content-Security-Policy-Report-Only” ( = deploy a Content-Security-Policy-Report-Only header).

This confirms that you are deploying CSP by another way that is not No unsafe-inline.

Maybe the CSP header is added by your provider or by your webserver. Please check that you don’t have an .htaccess file in your web-root directory that sets the CSP.

Two hints of what to check:

https://docs.litespeedtech.com/lsws/security-headers/#add-via-webadmin-console

https://support.hostinger.com/en/articles/2140906-what-to-do-if-a-website-shows-a-mixed-content-warning