';
echo esc_html( $enforcing ? __( 'Enforced', 'codo-content-security-policy' ) : __( 'Report-Only', 'codo-content-security-policy' ) );
echo ' — ';
echo esc_html(
$enforcing
? __( 'browsers block anything the policy does not allow. The admin area is never covered, so you can always get back here.', 'codo-content-security-policy' )
: __( 'nothing is blocked. Browsers report what the policy would block, so you can build it up safely.', 'codo-content-security-policy' )
);
echo '
';
}
/**
* One line about where reports go.
*
* @return string
*/
private function reporting_summary() {
if ( Settings::REPORTING_EXTERNAL === $this->settings->get( 'reporting' ) ) {
/* translators: %s: URL. */
return sprintf( __( 'Reports go to %s.', 'codo-content-security-policy' ), (string) $this->settings->get( 'external_uri' ) );
}
if ( $this->settings->is_collecting() ) {
return sprintf(
/* translators: %s: date and time. */
__( 'Collecting reports until %s.', 'codo-content-security-policy' ),
wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), (int) $this->settings->get( 'report_until' ) )
);
}
return __( 'Not collecting reports.', 'codo-content-security-policy' );
}
/**
* Policy tab for a context.
*
* @param string $context site or login.
* @return void
*/
private function render_policy_tab( $context ) {
if ( 'login' === $context ) {
echo '
' . esc_html__( 'wp-login.php has its own policy, because login security plugins (reCAPTCHA, Turnstile, two-factor) load scripts there that the rest of the site does not need.', 'codo-content-security-policy' ) . '
';
} else {
echo '
' . esc_html__( 'Sent on every front-end page, for visitors and logged-in users alike. Not sent in wp-admin, or inside page builders and the Customizer preview.', 'codo-content-security-policy' ) . '
';
}
if ( is_multisite() ) {
echo '
' . esc_html__( 'Network defaults are set by the network administrator and apply to every site.', 'codo-content-security-policy' ) . '
';
}
$this->view->render( $context, 'site' );
$this->render_header_preview( $context );
}
/**
* The headers as they are sent now.
*
* @param string $context Context.
* @return void
*/
private function render_header_preview( $context ) {
echo '
' . esc_html__( 'The headers are over 4 KB. NGINX with default FastCGI buffers can fail with "upstream sent too big header" (502). Remove sources you no longer need, or raise fastcgi_buffer_size.', 'codo-content-security-policy' ) . '
' . esc_html__( 'Browsers report what the policy blocks (or would block, in Report-Only). Identical reports are counted, not stored again; at most 500 different ones are kept, for 30 days. No IP addresses, user agents or full URLs are stored.', 'codo-content-security-policy' ) . '
';
echo '
' . esc_html__( 'Anyone can send a report, so treat them as suggestions: only allow sources you recognise. Sources a scan also found are marked.', 'codo-content-security-policy' ) . '
' . esc_html( sprintf( __( 'Reports are sent to %s, so none are collected here.', 'codo-content-security-policy' ), (string) $this->settings->get( 'external_uri' ) ) ) . '
' . esc_html(
sprintf(
/* translators: %s: number of reports. */
_n( 'The report table is full: %s report about a new violation was dropped.', 'The report table is full: %s reports about new violations were dropped.', $dropped, 'codo-content-security-policy' ),
number_format_i18n( $dropped )
)
) . ' ' . esc_html__( 'Until you clear the reports, a quiet Reports tab does not mean nothing is blocked. Clear them before enforcing or promoting a draft.', 'codo-content-security-policy' ) . '
' . esc_html__( 'A scan fetches a page as a logged-out visitor and checks every script, stylesheet, font, image, frame, media file and form target it finds (including fonts and images inside its stylesheets) against the policy. Published content is scanned automatically after it is saved.', 'codo-content-security-policy' ) . '
';
echo '
' . esc_html__( 'Resources added later by JavaScript (tag managers, chat widgets, ads) cannot be seen by a scan. Violation reports catch those.', 'codo-content-security-policy' ) . '
';
}
echo '';
}
/**
* The reviewed rules of a page's other policies, with a form to import them.
*
* @param array> $rows Reviewed rows.
* @param string $url Scanned URL.
* @param string $context Context.
* @return void
*/
private function render_import( array $rows, $url, $context ) {
if ( empty( $rows ) ) {
return;
}
$labels = array(
ImportReview::ADD => __( 'Safe to import', 'codo-content-security-policy' ),
ImportReview::CONFIRM => __( 'Risky: tick only if needed', 'codo-content-security-policy' ),
ImportReview::REFUSE => __( 'Refused', 'codo-content-security-policy' ),
ImportReview::SKIP => __( 'Not needed', 'codo-content-security-policy' ),
);
echo '
' . esc_html__( 'Import CSP rules from this page', 'codo-content-security-policy' ) . '
';
echo '
' . esc_html__( 'These rules come from outside this plugin (the server, a CDN, another plugin or a meta tag). Importing adds to your policy and removes nothing. Browsers enforce separate policies together, so a merged policy can allow more than they did: check each rule is one you need.', 'codo-content-security-policy' ) . '
';
$this->checkbox_row( 'login_enabled', __( 'Login page', 'codo-content-security-policy' ), __( 'Send a policy on wp-login.php (it has its own rules on the Login page tab).', 'codo-content-security-policy' ) );
$this->checkbox_row( 'skip_builders', __( 'Page builders', 'codo-content-security-policy' ), __( 'Leave out the policy in the Customizer preview and in front-end page builders (Elementor, Divi, Beaver Builder, Bricks, Oxygen, WPBakery, Thrive, Brizy, Avada) for users who can edit. Their editors inject inline code that an enforced policy would block.', 'codo-content-security-policy' ) );
$this->checkbox_row( 'upgrade_insecure', __( 'Upgrade insecure requests', 'codo-content-security-policy' ), __( 'Ask browsers to load http:// resources over https:// (only when enforced; browsers ignore it in Report-Only).', 'codo-content-security-policy' ) );
$this->checkbox_row( 'scan_on_save', __( 'Scan on save', 'codo-content-security-policy' ), __( 'Check published content against the policy in the background after it is saved.', 'codo-content-security-policy' ) );
$this->checkbox_row( 'purge_caches', __( 'Purge page caches', 'codo-content-security-policy' ), __( 'Clear page caches (WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed, Nginx Helper, SiteGround, WP-Optimize, Breeze) when the policy changes, so visitors get the new headers. Other caches and CDNs can use the codo_csp_purge_caches action.', 'codo-content-security-policy' ) );
$reporting = (string) $this->settings->get( 'reporting' );
$locked = $this->settings->is_locked( 'reporting' );
echo '
';
$choices = array(
Settings::REPORTING_BUILTIN => __( 'Collect them on this site (for a set period, started on the Reports tab)', 'codo-content-security-policy' ),
Settings::REPORTING_EXTERNAL => __( 'Send them to an external collector', 'codo-content-security-policy' ),
Settings::REPORTING_OFF => __( 'Off', 'codo-content-security-policy' ),
);
foreach ( $choices as $value => $label ) {
echo ' ';
}
echo '
';
echo '';
if ( $locked ) {
echo '
' . esc_html__( 'Set by CODO_CSP_REPORT_URI in wp-config.php.', 'codo-content-security-policy' ) . '
';
}
echo '
';
submit_button();
echo '';
echo '
' . esc_html__( 'Configuration in wp-config.php', 'codo-content-security-policy' ) . '
';
echo '
' . esc_html__( 'These constants override the settings above and show as read-only:', 'codo-content-security-policy' ) . '