I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header:
Header always set Content-Security-Policy "default-src 'self' https://blogname.com:*"
However, when I set this, the "edit/create Post" page in particular throws a bunch of errors which look to be related to:
- 3rd party fonts it needs to download
- Other stuff, probably related to plugins
How can I easily identify all the 3rd party URL's that are needed for Wordpress and all of its plugins, so that I can add them to the CSP header?