public static function send_csp_header() { $n = self::nonce(); // まず他プラグイン/テーマ/サーバが出した CSP を全部削除 // 送出順の違いに備えて、両方を消す header_remove('Content-Security-Policy'); header_remove('Content-Security-Policy-Report-Only'); // ▼ ここは Report-Only から開始(動作が安定したら本番CSPに切替) $csp = [ "default-src 'self'", "script-src 'self' 'nonce-{$n}' https://www.googletagmanager.com https://www.google-analytics.com", "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com", "img-src 'self' data: https: https://www.google-analytics.com https://stats.g.doubleclick.net https://secure.gravatar.com", "font-src 'self' https://fonts.gstatic.com data:", "connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://stats.g.doubleclick.net", "frame-src 'self' https://www.youtube.com https://player.vimeo.com https://www.google.com", "frame-ancestors 'self'", "object-src 'none'", "base-uri 'self'", "upgrade-insecure-requests" ]; header("Content-Security-Policy-Report-Only: " . implode('; ', $csp)); }
Kyoto Office
〒600-8846 京都市下京区朱雀宝蔵町34番地
梅小路MArKEt 3F
New York Office
31-00 47th Ave, Suite 3100, Long Island City,
NY 11101
Toronto office
20 Wellington St E, Suite 500, Toronto,
ON M5E 1C5