Hello Dyan,<\/p>\n
First off, kudos to a job well done! I am loving this plugin inside out. <\/p>\n
AS per your recommended instructions, upon initial setup, I made sure the CSP mode was set to Report Only. After scanning through my CSP log and Console in Google developer tools, I added the necessary content security polices to eliminate the errors.<\/p>\n
When I changed and saved the mode to “enforce policies”, I noticed when I use an online tool called CSP evaluator: https:\/\/csp-evaluator.withgoogle.com\/, or Security Headers: https:\/\/securityheaders.io\/, the results still show I don’t have a CSP enforced. <\/p>\n
However, after reading your post in this thread:<\/strong> when I navigate to the Network tab in Google Developer tools, I do see all the CSPs under Response headers.<\/p>\n Does this mean my CSPs are enforced correctly?<\/strong><\/p>\n Why are those two particular online CSP scanners telling me a different story?<\/strong> Is it because none of these CSPs are stored in my htaccess or apache.conf files?<\/p>\n Thanks for all you do Dylan! Your contribution and support are stupendous!<\/p>\n All my best,<\/p>\n Joe<\/p>\n","protected":false},"template":"","class_list":["post-9961628","topic","type-topic","status-publish","hentry","topic-tag-csp","topic-tag-referrer-policy"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/9961628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":2,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/9961628\/revisions"}],"predecessor-version":[{"id":9961631,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/9961628\/revisions\/9961631"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=9961628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nhttps:\/\/wordpress.org\/support\/topic\/not-currently-showing-up-in-scans-from-anyone\/
\n“Have a look at the network tab in developer tools and see if the initial page requested has Content-security-policy headers set.”<\/em><\/p>\n