PHPackages hk2/csp - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. hk2/csp ActiveMagento2-module[Security](/categories/security) hk2/csp ======= Magento 2 module to manage CSP whitelisted URLs v2.1.0(1mo ago)07581OSL-3.0PHPPHP ^8.1 || ^8.2 || ^8.3 || ^8.4CI passing Since Jun 16Pushed 1mo ago1 watchersCompare [ Source](https://github.com/basantmandal/magento2-csp-whitelisting-module)[ Packagist](https://packagist.org/packages/hk2/csp)[ RSS](/packages/hk2-csp/feed)WikiDiscussions main Synced 1w ago READMEChangelog (10)Dependencies (8)Versions (11)Used By (0) HK2 CSP Whitelisting ==================== [](#hk2-csp-whitelisting) [![Version](https://camo.githubusercontent.com/25e5293de9efa661e3a4e7940c403263a3fed20c661d878cc373e10e4ed580f6/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d332e302e302d626c75653f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/25e5293de9efa661e3a4e7940c403263a3fed20c661d878cc373e10e4ed580f6/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d332e302e302d626c75653f7374796c653d666c61742d737175617265)[![License](https://camo.githubusercontent.com/a3fd2257982f64afbde00a66a8ab5984ee3f6e176f00eb2ec4ea61d862bc113b/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e3f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/a3fd2257982f64afbde00a66a8ab5984ee3f6e176f00eb2ec4ea61d862bc113b/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e3f7374796c653d666c61742d737175617265)[![Magento](https://camo.githubusercontent.com/5c0e69cb7da2670c8c31d9baa7de3bb6e955ec4847f236b0c025d24cd587ac54/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342e342d2d322e342e392d6639373331363f7374796c653d666c61742d737175617265266c6f676f3d6d6167656e746f266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/5c0e69cb7da2670c8c31d9baa7de3bb6e955ec4847f236b0c025d24cd587ac54/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342e342d2d322e342e392d6639373331363f7374796c653d666c61742d737175617265266c6f676f3d6d6167656e746f266c6f676f436f6c6f723d7768697465)[![PHP](https://camo.githubusercontent.com/ad4f93eecb5fbaab9df06144c39ec979001e451fe5c303f11692bf6ba2aa14b8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e31253230253743253743253230382e32253230253743253743253230382e33253230253743253743253230382e342d3763336165643f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/ad4f93eecb5fbaab9df06144c39ec979001e451fe5c303f11692bf6ba2aa14b8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e31253230253743253743253230382e32253230253743253743253230382e33253230253743253743253230382e342d3763336165643f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465)[![Downloads](https://camo.githubusercontent.com/1a2ea97e83c7e475b1acf3d42bf706b40bd90c2cab063f9e3e2d7591a11edd6a/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f686b322f6373703f7374796c653d666c61742d737175617265)](https://packagist.org/packages/hk2/csp) Overview -------- [](#overview) HK2 CSP is a Magento 2 extension that enables administrators to manage Content Security Policy (CSP) whitelists dynamically. In addition to a robust set of pre-configured whitelist hosts for third-party scripts, styles, fonts, images, frames, and connections, it provides an admin interface to add custom domains without touching configuration files. 🎯 Use Cases ----------- [](#-use-cases) - **Third-Party Integrations**: Safe whitelisting for Google Analytics, Stripe, Facebook, and other standard services. - **Admin Management**: Direct, safe administrative management of CSP hosts dynamically. 🚀 Features ---------- [](#-features) - 🛡 Declares standard CSP policy parameters in `etc/csp.xml`. - 📦 Out-of-the-box whitelists for popular services (Google, Facebook, Stripe, Hotjar, Sentry, etc.). - ⚙️ Dynamic admin configurations for directive hosts (`script-src`, `style-src`, `img-src`, `connect-src`, `font-src`, `frame-src`). - 🔌 Backend validation plugin preventing invalid hosts or header injections. - 🔄 One-click dynamic "Reset CSP to Defaults" button via Ajax backend redirect. 🏗 Architecture -------------- [](#-architecture) - **Plugin**: `HK2\Csp\Plugin\PolicyListPlugin` intercepts `Magento\Csp\Model\Policy\PolicyList::getAllPolicies` to dynamically merge administrative hosts. - **Controller**: `HK2\Csp\Controller\Adminhtml\Reset\ResetConfig` handles configuration wipe operations. 🧩 Magento Components -------------------- [](#-magento-components) ### Blocks [](#blocks) - `HK2\Csp\Block\Adminhtml\System\Config\ResetButton` ### Plugins [](#plugins) - `HK2\Csp\Plugin\PolicyListPlugin` on `Magento\Csp\Model\Policy\PolicyList` ### Controllers [](#controllers) - `HK2\Csp\Controller\Adminhtml\Reset\ResetConfig` 📦 Requirements -------------- [](#-requirements) - **Magento version**: 2.4.4 - 2.4.9 - **PHP requirements**: 8.1 || 8.2 || 8.3 || 8.4 - **Required Extension**: `HK2_Core` ⚙️ Installation --------------- [](#️-installation) 1. `composer require hk2/csp` 2. `bin/magento module:enable HK2_Csp` 3. `bin/magento setup:upgrade` 4. `bin/magento setup:di:compile` 5. `bin/magento cache:flush` 🔧 Configuration --------------- [](#-configuration) Configure settings under **Stores > Configuration > HK2 > CSP Whitelisting**: FieldDescription**Script Src URLs**Comma-separated list of script host domains (e.g. `*.example.com`).**Style Src URLs**Comma-separated list of style host domains.**Image Src URLs**Comma-separated list of image host domains.**Connect Src URLs**Comma-separated list of connect/API host domains.**Font Src URLs**Comma-separated list of font host domains.**Frame Src URLs**Comma-separated list of frame/iframe host domains.**Reset CSP**Button to clear all scopes and restore default whitelists.Usage ----- [](#usage) Navigate to **Stores > Configuration > HK2 > CSP Whitelisting**, populate domains matching your external integrations, and save. Run `bin/magento cache:flush` to apply. 🗄 Database Changes ------------------ [](#-database-changes) Not Applicable 📂 Module Structure ------------------ [](#-module-structure) ``` Block/ └── Adminhtml/ └── System/ └── Config/ └── ResetButton.php Controller/ └── Adminhtml/ └── Reset/ └── ResetConfig.php Plugin/ └── PolicyListPlugin.php etc/ ├── adminhtml/ │ ├── menu.xml │ ├── routes.xml │ └── system.xml ├── acl.xml ├── config.xml ├── csp.xml ├── csp_whitelist.xml ├── di.xml └── module.xml view/ └── adminhtml/ └── templates/ └── system/ └── config/ └── reset_button.phtml ``` 📈 Performance Considerations ---------------------------- [](#-performance-considerations) The policies list is cached inside Magento's standard configuration cache, preventing database queries or regex calculations on standard page loads. 🔐 Security Considerations ------------------------- [](#-security-considerations) - **Input Validation**: `isValidCspHost` prevents semicolons, commas, and white spaces in custom values, protecting the headers against header splitting or policy injection attacks. Compatibility ------------- [](#compatibility) Reference: [docs/compatibility.md](docs/compatibility.md) PlatformSupported VersionsMagento2.4.4 - 2.4.9PHP8.1, 8.2, 8.3, 8.4🛠 Troubleshooting ----------------- [](#-troubleshooting) ### Dynamic values not appearing in CSP header [](#dynamic-values-not-appearing-in-csp-header) Verify you have flushed the configuration cache after making changes: `bin/magento cache:flush`. 🤝 Contributing -------------- [](#-contributing) Contributions are welcome! If you'd like to improve the installer: - ⭐ **Star this repository** (Helps others find it!) - 🍴 Fork the project - 🐛 Report bugs - 💡 Suggest new features - 🤝 Contribute improvements Every ⭐ helps increase the visibility of the project and motivates further development. ⚖️ Disclaimer ------------- [](#️-disclaimer) The author provides this installation script "as is" without any warranties. Users are responsible for ensuring that running this script complies with their internal security and software requirements. 🤝 Support --------- [](#-support) For bug reports, feature requests, and general support: - **Author**: Basant Mandal - **Email**: - **Website**: License ------- [](#license) This project is licensed under the OSL 3.0 License. See the [LICENSE.txt](LICENSE.txt) file for details. --- ### Health Score 52 — FairBetter than 96% of packages Maintenance94 Actively maintained with recent releases Popularity18 Limited adoption so far Community10 Small or concentrated contributor base Maturity72 Established project with proven stability Bus Factor1 Top contributor holds 92.1% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~186 days Recently: every ~16 days Total 9 Last Release 33d ago Major Versions 1.0.3 → 2.0.02026-05-11 v1.0.1 → v2.1.02026-07-16 PHP version history (3 changes)1.0.0PHP ^7.3.0|^7.4.0|^8.0|^8.1.0 1.0.2PHP ^7.3.0|^7.4.0|^8.0|^8.1.0|^8.2.0 2.0.0PHP ^8.1 || ^8.2 || ^8.3 || ^8.4 ### Community Maintainers ![](https://www.gravatar.com/avatar/ffa270f1557c4c55c55fec1ad6f2544170980c8dd7f679c10582a3736f7d3a4c?d=identicon)[basantmandal](/maintainers/basantmandal) --- Top Contributors [![basantmandal](https://avatars.githubusercontent.com/u/69835601?v=4)](https://github.com/basantmandal "basantmandal (35 commits)")[![semantic-release-bot](https://avatars.githubusercontent.com/u/32174276?v=4)](https://github.com/semantic-release-bot "semantic-release-bot (3 commits)") --- Tags cspmagento2modulesecurityextensioncspcontent-security-policymagento2magento2 extensionwhitelistHK2BasantHK2\_Cspmagento modulebasantmandalwhitelist url ### Embed Badge ![Health badge](/badges/hk2-csp/health.svg) ``` [![Health](https://phpackages.com/badges/hk2-csp/health.svg)](https://phpackages.com/packages/hk2-csp) ``` ### Alternatives [spatie/laravel-csp Add CSP headers to the responses of a Laravel app 86911.6M28](/packages/spatie-laravel-csp)[myparcelnl/magento A Magento 2 module that creates MyParcel labels 1861.2k](/packages/myparcelnl-magento)[angeo/module-llms-txt Magento 2 module for AI Engine Optimization (AEO). Generates spec-compliant llms.txt and llms-full.txt per llmstxt.org standard, plus streaming JSONL for vector indexing. Multi-store, multi-website, CLI, cron, async admin UI, Page Builder-aware sanitization, customer-group pricing, atomic writes, ETag/Cache-Control, .md mirrors. 132.2k](/packages/angeo-module-llms-txt) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)