CSP Violation Reporter helps site administrators investigate Content Security Policy violations. It receives browser reports through a public WordPress REST endpoint, stores them in the site’s own database, and provides a searchable administrative dashboard.

Reports can be reviewed from Tools > CSP Violations. The plugin supports the modern Reporting API payload format as well as the older csp-report JSON shape.

Review violations by directive, blocked resource, document URL, disposition and date.
Group noisy resources and count repeated occurrences without storing an extra row for every identical report.
Inspect safely escaped raw JSON, source locations, referrers and first/last-seen timestamps.
Configure rate limits, retention and the maximum number of stored records.
Receive same-origin iframe reports and automatically upgrade the database schema without reactivation.

Filter by directive, disposition, URL and date range, or group violations by resource. Repeated violations with the same document, blocked resource, directive, policy and source location share one record with an occurrence count. Each record includes first/last-seen timestamps and the latest raw JSON report.

Protection is enabled by default:

Accepts document URLs only from the origins configured in this site’s WordPress Address and Site Address. Redacted iframe reports require a local referrer.
Limits intake to 100 reports per minute per connecting address and 1,000 reports per minute for the site.
Limits request bodies to 64 KiB, individual normalized reports to 16 KiB and batches to 50 entries.
Removes inactive reports after 30 days and retains at most 10,000 records, keeping the most recently seen.

Retention and quotas can be adjusted in Tools > CSP Violations > Settings. Existing reports are preserved during schema upgrades; retention rules also apply to pre-upgrade reports.

Endpoint:

/wp-json/csp-violation-reporter/v1/report

The plugin does not create or modify Content Security Policy headers. Site owners should configure CSP headers in their web server, hosting dashboard, theme, or security tooling.

Example report endpoint configuration:

Content-Security-Policy: default-src 'self'; report-uri https://example.com/wp-json/csp-violation-reporter/v1/report

For the modern Reporting API, use an HTTPS endpoint:

Reporting-Endpoints: csp-endpoint="https://example.com/wp-json/csp-violation-reporter/v1/report"

Content-Security-Policy: default-src 'self'; report-to csp-endpoint

Privacy

This plugin stores CSP violation reports submitted by browsers. Stored fields can include the document URL, referrer URL, blocked URI, violated directive, source file, line and column numbers, a user agent string, a salted hash of the remote address, and the raw report payload.

Short-lived rate-limit records contain a salted address hash and counters. Raw JSON can contain URL query parameters and other information supplied by the browser. Administrators should set retention to suit their site’s privacy policy. Reports expire by last-seen time and can also be cleared manually. Uninstalling removes the plugin’s report tables, protection settings and scheduled cleanup events.

The plugin does not store raw IP addresses and does not transmit report data to external services.