I am currently setting up a web server for WordPress. Ubuntu 18 with Apache2 behind Cloudflare. The WebSite is connected to WordPress JetPack. Everything is up and running, but I am stuck at configuring the Content-Security-Policy header.

Does a best practice exist, to allow everything to let JetPack work but not more? What has to be loaded from where and how?

I tried s far, and it works partially. Also, this is not a clean solution because it allows probably a bit too much.

<IfModule mod_ssl.c>
    <VirtualHost *:443>

        Header set Content-Security-Policy "default-src 'self'; script-src 'self' *.w.org *.wp.com *.gravatar.com *.jetpack.com; object-src 'self' *.w.org *.wp.com *.gravatar.com *.jetpack.com; style-src 'self' *.w.org *.wp.com *.w.org *.wp.com *.gravatar.com *.jetpack.com; img-src 'self' data: *.w.org *.wp.com *.gravatar.com *.jetpack.com; media-src 'self' *.w.org *.wp.com *.gravatar.com *.jetpack.com; child-src 'self' *.w.org *.wp.com *.gravatar.com *.jetpack.com; font-src 'self' *.w.org *.wp.com; connect-src 'self' *.w.org *.wp.com *.gravatar.com *.jetpack.com;"



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy