Content Security Policy Manager

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 99% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

1. ★★★★★ ningmorris

   3.1y ago

   Hello, Since report-uri is no longer recommended anymore, I need to use report-to to send CSP reports. But for reason, it doesn’t send reports with report-to. My CSP settings are as follows: In Policy: report-to filed, I filled in csp-endpoint , in Frontend Policy Report-To Header field, I filled in the following JSON data { "group": "csp-endpoint", "max_age": 10886400, "endpoints": [ { "url": "{CSP REPORT ENDPOINT}" } ] } After saving changes in the CMS, all the commas disappeared in Frontend Policy Report-To Header field. { "group": "csp-endpoint" "max_age": 10886400 "endpoints": [ { "url": "{CSP REPORT ENDPOINT}" } ] } I am wondering if you can help to take a look at it, thanks! Note: I have no problem with report-uri. This topic was modified 3 years ago by ningmorris.

   Read on wp.org ↗
2. ★★★★★ rintelengrafik

   3.5y ago

   As soon as I leave the backend the view of my side is without any CSS. Only the plain HTML.

   Read on wp.org ↗
3. ★★★★★ buzibuzi

   3.6y ago

   We are really happy with this plugin.im wondering if you provide a filter so i can merge some dynamic ‘nonce-xx’ to the policy header. this could be very very useful.

   Read on wp.org ↗
4. ★★★★★ Jason Robinson

   4.4y ago

   This plugin is well thought out and does what I need it to. It has also helped me troubleshoot other website’s CSP that wasn’t working correctly, and the documentation is solid if brief.

   Read on wp.org ↗
5. ★★★★★ jeebeezebee

   4.8y ago

   Ce plugin m;a fait gagner des heures de travail.

   Read on wp.org ↗
6. ★★★★★ c3idesign

   5.3y ago

   Great plugin, thank you.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.2.1 Fix error caused by improperly checking the chosen CSP mode when outputting headers (thanks @reatlat). 1.2.1
2. — Version 1.2.0 Improved UI, with CSP directives divided into collapsible categories. Add all remaining non-deprecated CSP directives. Warn if enabling upgrade-insecure-requests on a site that does not support HTTPS. Sanitize directives 1.2.0
3. — Version 1.1.0 This is a relatively small update, that only contains a few more CSP directives. The next update will contain even more, along with an updated user interface. Add some commonly used CSP headers that were missing (thanks 1.1.0
4. — Version 1.0.0 First version. Support for different policies for admin, logged-in frontend and regular visitors. Different policies can have different reporting/enforcing mode. Directives can be configured separately, to easier see wha 1.0.0

Automated install-time checks, tested on PHP 7.4.8 · WP 6.0.1

Translated into 1 language, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-12-28 3K+ → 2K+ down after 1 days in tier
2. 2024-12-27 2K+ → 3K+ up after 4 days in tier
3. 2024-12-23 3K+ → 2K+ down after 552 days in tier
4. 2023-06-20 2K+ → 3K+ up after 5 days in tier
5. 2023-06-15 3K+ → 2K+ down after 2 days in tier
6. 2023-06-13 2K+ → 3K+ up after 214 days in tier
7. 2022-11-11 1K+ → 2K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• GD Security Headers 1K+ installs · 3.9★ · 3 shared tags B
• Security Header Generator 500+ installs · 4.2★ · 3 shared tags A
• Prevent XSS Vulnerability 6K+ installs · 4.3★ · 2 shared tags C
• HTTP Security Header 1K+ installs · 4.1★ · 2 shared tags B
• Auto SRI 500+ installs · 3.6★ · 2 shared tags B
• Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 1 shared tag A

Embed this report card

Drop a live Pulse card for Content Security Policy Manager into a readme, a review or a deck. It updates itself.

Content Security Policy Manager: 2K+ active installs, 4.3★ (6 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/csp-manager