CSP Friendly Security

I downloaded this plugin and modified it for my site. I would recommend doing that. The plugin hooks into the 'template_redirect' hook. At that point the source for the page has been generated by themes and plugins and is ready to be sent. The plugin looks through the generated source and makes nonces for all inline scripts and styles. It modifies the source so the inline scripts and styles have a nonce='some-nonce' statement in them. It creates a Content-Security-Policy which includes those nonces.

However, each site has its own CSP needs, and so modifying the plugin to tailor the CSP to your site is not that difficult to do. That is what I have done.

doesn't seem to work properly with w3tc. hope it will get updated at some point.

The plugin works as advertised however, it does not let you modify the CSP header resulting in a less than ideal CSP header. The header this plugin serves provides no protection against clickjacking and allows all external scripts.

This is the most 'straight to the point' CSP tool that I've found. So far, so go.