Docs

Hooks and constants

Last updatedView as Markdown

Filters, actions and constants a site or another plugin can use to change how Consepo for WordPress behaves.

Filters

Reference

Filters

Each receives the arguments listed and returns the first one, changed or not.
7 fields
consepo_csp_scanner_api_url string
The Consepo origin, without a trailing slash. Receives the value of CONSEPO_CSP_SCANNER_API_URL when it is defined.
Defaulthttps://consepo.com
consepo_csp_scanner_send_policy boolean
Whether to send the header on this request. Second argument: the header as an array with name and value.
Defaulttrue
consepo_csp_scanner_policy_directives array
Directive name => list of sources, just before the policy is serialised, after the nonce and report-uri are added. Second argument: the settings. Also shapes the Header preview.
consepo_csp_scanner_asset_bases array
Base URL => directory pairs that local assets may be hashed from.
Defaultcontent, plugins, includes, site and home URLs
consepo_csp_scanner_pre_api_request any
Return an array (a decoded response body) or a WP_Error to skip a Consepo API request. Further arguments: method, path, JSON body. Used by tests and local mocks.
Defaultnull
consepo_csp_scanner_oauth_scope string
The space-separated scope requested when signing in with Consepo.
Defaultscans:read scans:write reports:read
consepo_csp_scanner_oauth_client_id string
A pre-registered OAuth client id, for a Consepo that does not offer dynamic client registration. Second argument: the redirect URI.

consepo_csp_scanner_send_policy and consepo_csp_scanner_policy_directives run on send_headers, before WordPress runs the main query, so conditional tags such as is_page() are not available yet. Decide from the request, as in the example below.

The plugin also honours core's https_local_ssl_verify filter for the Check home page loopback request.

php mu-plugins/consepo-tweaks.php 
<?php// Send no policy under /checkout/. This runs on send_headers, before the// main query, so decide from the request rather than is_page() or is_checkout().add_filter(	'consepo_csp_scanner_send_policy',	static function ( bool $send ): bool {		$path = (string) wp_parse_url( $_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH );		return $send && ! str_starts_with( $path, '/checkout/' );	});// Allow a payment provider's frames. Start from default-src when frame-src is// missing, or the new directive would allow only this one host.add_filter(	'consepo_csp_scanner_policy_directives',	static function ( array $directives ): array {		$frames                 = $directives['frame-src'] ?? $directives['default-src'] ?? [];		$directives['frame-src'] = array_merge( $frames, [ 'https://js.stripe.com' ] );		return $directives;	});
Two common customisations, in a must-use plugin.

Actions

ActionArgumentsFires
consepo_csp_scanner_readyThe Bootstrap instanceOn plugins_loaded, once every controller has registered its hooks
consepo_csp_scanner_activatedNoneAfter activation has stored the defaults and scheduled the refresh

Constants

ConstantSet byPurpose
CONSEPO_CSP_SCANNER_API_URLYou, in wp-config.phpUse a staging or local Consepo origin instead of https://consepo.com
CONSEPO_CSP_SCANNER_VERSIONThe pluginThe installed version
CONSEPO_CSP_SCANNER_FILE, CONSEPO_CSP_SCANNER_PATH, CONSEPO_CSP_SCANNER_URL, CONSEPO_CSP_SCANNER_BASENAMEThe pluginThe main file, its directory and URL, and its plugin basename

consepo_csp_scanner_version() returns the installed version, or 0.0.0 when the plugin has not booted.

Have a question about this page?

Linchpin assistant

Was this helpful?