PHPackages                             ctidigital/magento2-csp-whitelist - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. ctidigital/magento2-csp-whitelist

ActiveMagento2-module[Security](/categories/security)

ctidigital/magento2-csp-whitelist
=================================

Control CSP via the admin area

1.0.1(5y ago)21234.2k↓44.3%4[2 issues](https://github.com/ctidigital/magento2-csp-whitelist/issues)MITPHP

Since Feb 9Pushed 5y ago9 watchersCompare

[ Source](https://github.com/ctidigital/magento2-csp-whitelist)[ Packagist](https://packagist.org/packages/ctidigital/magento2-csp-whitelist)[ RSS](/packages/ctidigital-magento2-csp-whitelist/feed)WikiDiscussions master Synced 2w ago

READMEChangelog (2)DependenciesVersions (3)Used By (0)

Magento 2 CSP Whitelist
=======================

[](#magento-2-csp-whitelist)

A Magento 2 module created by [CTI Digital](https://www.ctidigital.com/) to create and maintain Content Security Policies via the admin panel.

Installation
------------

[](#installation)

- `composer require ctidigital/magento2-csp-whitelist`
- `php bin/magento module:enable CtiDigital_CspWhitelist`
- `php bin/magento setup:upgrade`

Usage
-----

[](#usage)

Identify the resource blocked by the Content Security Policy:

```
Refused to load https://www.google-analytics.com/analytics.js because it does not appear in the script-src directive of the Content Security Policy.

```

1. Take note of the resource `google-analytics.com` or `*.google-analytics.com`.
2. Check which policy it violates `script-src`.
3. Navigate to admin panel `Stores->Configuration->Cti->CSP Whitelist`
4. Ensure the module is enabled. Add a new row, select a resource and add the value.
5. Save and flush the relevant caches.

Policies
--------

[](#policies)

```
POLICY NAME	DESCRIPTION
default-src	The default policy.
base-uri	Defines which URLs can appear in a page’s  element.
child-src	Defines the sources for workers and embedded frame contents.
connect-src	Defines the sources that can be loaded using script interfaces.
font-src	Defines which sources can serve fonts.
form-action	Defines valid endpoints for submission from  tags.
frame-ancestors	Defines the sources that can embed the current page.
frame-src	Defines the sources for elements such as  and .
img-src         Defines the sources from which images can be loaded.
manifest-src	Defines the allowable contents of web app manifests.
media-src	Defines the sources from which images can be loaded.
object-src	Defines the sources for the , , and  elements.
script-src	Defines the sources for JavaScript  elements.
style-src	Defines the sources for stylesheets.

```

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance18

Infrequent updates — may be unmaintained

Popularity44

Moderate usage in the ecosystem

Community12

Small or concentrated contributor base

Maturity55

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

2017d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/6105453?v=4)[paulpartington-cti](/maintainers/paulpartington-cti)[@paulpartington-cti](https://github.com/paulpartington-cti)

---

Top Contributors

[![paulpartington-cti](https://avatars.githubusercontent.com/u/6105453?v=4)](https://github.com/paulpartington-cti "paulpartington-cti (1 commits)")

### Embed Badge

![Health badge](/badges/ctidigital-magento2-csp-whitelist/health.svg)

```
[![Health](https://phpackages.com/badges/ctidigital-magento2-csp-whitelist/health.svg)](https://phpackages.com/packages/ctidigital-magento2-csp-whitelist)
```

###  Alternatives

[phpids/phpids

PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application

791150.0k2](/packages/phpids-phpids)[paragonie/ecc

PHP Elliptic Curve Cryptography library

25866.3k44](/packages/paragonie-ecc)[sansec/magento2-module-shield

15218.6k](/packages/sansec-magento2-module-shield)[nicobleiler/php-passphrase

Passphrase generator with Laravel integration, inspired by Bitwarden. Uses the EFF long word list by default with support for custom wordlists.

4912.6k](/packages/nicobleiler-php-passphrase)[dwgebler/encryption

Encryption wrapper for PHP using libsodium — simple API for symmetric and asymmetric encryption, password hashing, digital signing, and message authentication.

317.5k](/packages/dwgebler-encryption)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)