Title: Script Sentinel Author: scriptsentinel Published: September 2, 2026 Last modified: September 2, 2026 --- Search plugins ![](https://ps.w.org/script-sentinel/assets/banner-772x250.png?rev=3678342) ![](https://ps.w.org/script-sentinel/assets/icon-256x256.png?rev=3678342) # Script Sentinel By [scriptsentinel](https://profiles.wordpress.org/scriptsentinel/) [Download](https://downloads.wordpress.org/plugin/script-sentinel.0.1.0.zip) * [Details](https://wordpress.org/plugins/script-sentinel/#description) * [Reviews](https://wordpress.org/plugins/script-sentinel/#reviews) * [Installation](https://wordpress.org/plugins/script-sentinel/#installation) * [Development](https://wordpress.org/plugins/script-sentinel/#developers) [Support](https://wordpress.org/support/plugin/script-sentinel/) ## Description Script Sentinel gives administrators a free, manual scan of the canonical public home page and up to nine additional same-origin pages. It displays a generated Content Security Policy (CSP), score, page count, and warnings. WordPress scans take no screenshots. A scan never changes headers. A `manage_options` administrator may separately activate a complete reviewed candidate. The plugin emits one `Content-Security-Policy` header only on eligible logged-out public 2xx HTML/XHTML `GET` and `HEAD` responses. It excludes private/admin traffic, REST, AJAX, cron, feeds, previews, XML-RPC, CLI, redirects, errors, and non-HTML responses. Activation checks credential-free public `GET` and `HEAD` responses before and after the change. Status distinguishes locally stored state from exact publicly verified delivery. A failed check stays visible and does not silently deactivate or roll back. Administrators can verify again, deactivate, restore one prior state, or use the emergency bypass. Script Sentinel suppresses its header when PHP/WordPress exposes another enforced CSP. Headers added later by a host, proxy, cache, or CDN are outside PHP’s reliable view, so test on staging and inspect the final uncached response. Premium CSP Autopilot is an optional paid hosted service. Script Sentinel’s servers provide recurring verified-site scans, drift comparison, reduced CSP report aggregates, and staged rollout coordination. Payment covers those hosted operations; it does not unlock or extend local CSP controls. Enrollment is explicit. Safe drift can move through report-only observation, simulation, production probation, and exact commit or rollback; trust-expanding or unknown drift waits for approval. #### What “up to 10 pages” means The hosted free WordPress endpoint currently accepts at most one valid scan per canonical site during a rolling 60-minute period. Each scan can visit up to ten eligible public same-origin pages and may reach fewer. This service capacity and abuse-prevention limit applies only to hosted scans; it does not expire or disable local CSP controls. #### External service and data use This plugin uses the Script Sentinel service at https://script-sentinel.com/. Before an administrator starts a scan or Premium pairing, activation and ordinary administrator-page rendering send nothing to Script Sentinel. After Premium is connected, traffic-driven WP-Cron may start the separately disclosed agent synchronization during any request. When an administrator explicitly clicks Scan, the browser sends to `https://script-sentinel.com/api/v1/wordpress/scan`: * The canonical public HTTPS site URL and public WordPress REST proof URL. * A five-minute single-use proof and non-secret request identifier. * Scan options and the requested 10-page maximum. * Ordinary connection metadata such as IP address and user agent. The service returns the proof once to the public proof route, then visits public pages and resources. Their third-party hosts can observe scanner requests. The plugin sends no WordPress cookies, credentials, administrator email, authenticated content, user identity, or screenshots. Free mode stores the latest bounded result locally. If CSP deployment is used, WordPress also stores the active policy, checksum/fingerprint/change metadata, one rollback state, conflict status, short-lived HMAC-only delivery probes, and bounded delivery evidence in non-autoloaded options. Free deployment and verification do not contact Script Sentinel, and free mode performs no recurring service call. Premium pairing contact starts only after a WordPress administrator explicitly selects Connect Premium. Pairing sends the site URL, public WordPress site name/installation label, random installation ID, proof/challenge, profile/scopes, and plugin/protocol versions. PHP exchanges proof-bound machine credentials and stores them encrypted in non-autoloaded options. Automatic Autopilot CSP changes begin only after the authenticated Script Sentinel account explicitly approves and enrolls the installation. While connected, one serialized PHP agent normally contacts Script Sentinel every five minutes. It sends bounded installation/site identity, local CSP digests, revision, mode, watchdog/conflict state, command sequence, and acknowledgement, and receives at most one CSP command. Public responses never wait for this request. During Premium report-only or probation stages, eligible public browsers may send CSP violation reports to a random opaque Script Sentinel report endpoint. Normal network infrastructure may process connection metadata such as IP address and user agent for delivery and abuse prevention. Report bodies are reduced to bounded aggregates containing disposition/directive, normalized blocked source, redacted same-site path, original-policy digest, ambiguity, count, and timestamps. Script Sentinel retains those aggregates for at most 30 days and does not retain raw report bodies, raw policies, full URLs, queries/fragments, referrers, samples, cookies, authorization values, or client addresses in report aggregate rows. See the Privacy Policy for the complete service record. Premium sends no WordPress cookies, administrator credentials, private-page content, OAuth tokens, or Stripe IDs. Disconnect returns the committed CSP to local mode and removes credentials; use dashboard revoke if remote revocation cannot be confirmed. Uninstall removes local state without a remote request. Review these terms before using the service: * Service: https://script-sentinel.com/ * Pricing: https://script-sentinel.com/pricing * Terms of Service: https://script-sentinel.com/terms * Privacy Policy: https://script-sentinel.com/privacy * Authorized-use and scanner limits: https://script-sentinel.com/about#scanner- limits-title ### Privacy See **External service and data use** above plus https://script-sentinel.com/privacy. Uninstall removes all local result, proof, deployment, verification, credential, agent, and scheduled-hook state without remote contact. Revoke a Premium installation in the dashboard if offline uninstall could not notify the service. ## Installation 1. Install the release ZIP from **Plugins > Add New > Upload Plugin**, or copy `script- sentinel` to `/wp-content/plugins/`. 2. Activate **Script Sentinel** and open **Tools > Script Sentinel**. 3. Read the external-service notice and choose **Scan up to 10 pages**. 4. Review the complete result. On staging, choose **Activate latest CSP**, inspect the public `GET` and `HEAD` verification, test the site, and purge page/CDN caches after changes. The site must be public HTTPS, expose the REST proof route, and serve administration from its canonical origin. Local/private, HTTP, split-origin, unreachable, and Basic- Auth-only sites cannot complete a real scan. ## FAQ ### Does scanning change my CSP? No. A complete result remains inactive until an administrator separately chooses** Activate latest CSP** and confirms the warning. Partial or header-unsafe results cannot be activated. ### What does “Stored active” mean? WordPress accepted the local deployment record. It is not proof that a host, cache, proxy, or CDN delivered it. The plugin reports delivery verified only after cookie- free public `GET` and `HEAD` requests reach its eligible response hook and return the exact policy identity. ### Why is no CSP visible after activation? A cache, server, proxy, CDN, redirect, excluded response, or competing CSP can bypass WordPress output. Purge caches, inspect the final anonymous response, remove competing policies, then verify again. Failure does not automatically remove local state. ### How do I recover if enforcement breaks the site? Use **Deactivate CSP** or **Restore prior state** under Tools. If needed, add `define(' SCRIPT_SENTINEL_DISABLE_CSP', true );` to `wp-config.php` and purge caches. Deactivating the plugin also stops emission. Remove the bypass only after correcting and testing the policy. ### Does the plugin scan wp-admin or logged-in content? No. Scanning starts from the public canonical URL. WordPress cookies and credentials are not sent. A public crawl cannot prove personalized, ecommerce, membership, consent, geolocation, feature-flag, or time-dependent flows. ### Is an account required? No for free manual scans and explicit local CSP deployment. Premium pairing and Autopilot require an eligible verified Script Sentinel account/monitor and explicit administrator enrollment. ### What happens after Premium enrollment? The five-minute agent pulls CSP lifecycle commands. Safe candidates are observed in report-only mode, simulated, and tested during bounded enforcement probation before commit. Trust-expanding/unknown candidates wait for exact approval. Missing evidence, violations, conflicts, expiry, downgrade, or disconnect retain or restore the last-known-good local state. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Script Sentinel” is open source software. The following people have contributed to this plugin. Contributors * [ scriptsentinel ](https://profiles.wordpress.org/scriptsentinel/) [Translate “Script Sentinel” into your language.](https://translate.wordpress.org/projects/wp-plugins/script-sentinel) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/script-sentinel/), check out the [SVN repository](https://plugins.svn.wordpress.org/script-sentinel/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/script-sentinel/) by [RSS](https://plugins.trac.wordpress.org/log/script-sentinel/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.1.0 * Initial public release. * Scan up to 10 public pages and review a generated CSP without screenshots. * Explicitly deploy, verify, deactivate, or restore a local CSP with conflict detection and emergency recovery. * Optionally connect eligible accounts to Premium CSP Autopilot with report-only validation, probation, commit, and rollback safeguards. * Include complete service disclosures, WordPress 7.1 compatibility metadata, and reproducible release checks. ## Meta * Version **0.1.0** * Last updated **11 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [content security policy](https://wordpress.org/plugins/tags/content-security-policy/) [csp](https://wordpress.org/plugins/tags/csp/)[scanner](https://wordpress.org/plugins/tags/scanner/) [Security Headers](https://wordpress.org/plugins/tags/security-headers/)[WebSite Security](https://wordpress.org/plugins/tags/website-security/) * [Advanced View](https://wordpress.org/plugins/script-sentinel/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/script-sentinel/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/script-sentinel/reviews/) ## Contributors * [ scriptsentinel ](https://profiles.wordpress.org/scriptsentinel/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/script-sentinel/)