[ad_1]
[ad_2]
I self-host a WordPress blog and my recent goal has been to ensure it's as secure as possible. One issue I've encountered is that many of my plugins only work if I include the unsafe-inline directive in the script-src section of my CSP in NGINX. As soon as I remove the unsafe-inline directive—following the recommendations from various security guides—everything breaks.
Some research suggests using a nonce in the code, but since the problematic code is part of plugins, I'm unsure how to address this issue.
How should I handle this situation? Is it feasible to use a nonce as recommended in WordPress?