---
title: Hooks and constants
---

Filters, actions and constants a site or another plugin can use to change how Consepo for WordPress behaves.

## Filters

<!-- wp:docspress/fields {"title":"Filters","description":"Each receives the arguments listed and returns the first one, changed or not.","fields":[{"name":"consepo_csp_scanner_api_url","type":"string","required":false,"defaultValue":"https://consepo.com","description":"The Consepo origin, without a trailing slash. Receives the value of CONSEPO_CSP_SCANNER_API_URL when it is defined.","values":"","deprecated":false},{"name":"consepo_csp_scanner_send_policy","type":"boolean","required":false,"defaultValue":"true","description":"Whether to send the header on this request. Second argument: the header as an array with name and value.","values":"","deprecated":false},{"name":"consepo_csp_scanner_policy_directives","type":"array","required":false,"defaultValue":"","description":"Directive name =\u003e list of sources, just before the policy is serialised, after the nonce and report-uri are added. Second argument: the settings. Also shapes the Header preview.","values":"","deprecated":false},{"name":"consepo_csp_scanner_asset_bases","type":"array","required":false,"defaultValue":"content, plugins, includes, site and home URLs","description":"Base URL =\u003e directory pairs that local assets may be hashed from.","values":"","deprecated":false},{"name":"consepo_csp_scanner_pre_api_request","type":"any","required":false,"defaultValue":"null","description":"Return an array (a decoded response body) or a WP_Error to skip a Consepo API request. Further arguments: method, path, JSON body. Used by tests and local mocks.","values":"","deprecated":false},{"name":"consepo_csp_scanner_oauth_scope","type":"string","required":false,"defaultValue":"scans:read scans:write reports:read","description":"The space-separated scope requested when signing in with Consepo.","values":"","deprecated":false},{"name":"consepo_csp_scanner_oauth_client_id","type":"string","required":false,"defaultValue":"","description":"A pre-registered OAuth client id, for a Consepo that does not offer dynamic client registration. Second argument: the redirect URI.","values":"","deprecated":false}],"searchable":true,"compact":false} /-->

`consepo_csp_scanner_send_policy` and `consepo_csp_scanner_policy_directives` run on `send_headers`, before WordPress runs the main query, so conditional tags such as `is_page()` are not available yet. Decide from the request, as in the example below.

The plugin also honours core's `https_local_ssl_verify` filter for the **Check home page** loopback request.

<!-- wp:docspress/colorful-code {"language":"php","filename":"mu-plugins/consepo-tweaks.php","code":"\u003c?php\n// Send no policy under /checkout/. This runs on send_headers, before the\n// main query, so decide from the request rather than is_page() or is_checkout().\nadd_filter(\n\t'consepo_csp_scanner_send_policy',\n\tstatic function ( bool $send ): bool {\n\t\t$path = (string) wp_parse_url( $_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH );\n\t\treturn $send \u0026\u0026 ! str_starts_with( $path, '/checkout/' );\n\t}\n);\n\n// Allow a payment provider's frames. Start from default-src when frame-src is\n// missing, or the new directive would allow only this one host.\nadd_filter(\n\t'consepo_csp_scanner_policy_directives',\n\tstatic function ( array $directives ): array {\n\t\t$frames                 = $directives['frame-src'] ?? $directives['default-src'] ?? [];\n\t\t$directives['frame-src'] = array_merge( $frames, [ 'https://js.stripe.com' ] );\n\t\treturn $directives;\n\t}\n);","highlightedLines":"","showLineNumbers":true,"caption":"Two common customisations, in a must-use plugin."} /-->

## Actions

| Action | Arguments | Fires |
| --- | --- | --- |
| `consepo_csp_scanner_ready` | The `Bootstrap` instance | On `plugins_loaded`, once every controller has registered its hooks |
| `consepo_csp_scanner_activated` | None | After activation has stored the defaults and scheduled the refresh |

## Constants

| Constant | Set by | Purpose |
| --- | --- | --- |
| `CONSEPO_CSP_SCANNER_API_URL` | You, in `wp-config.php` | Use a staging or local Consepo origin instead of `https://consepo.com` |
| `CONSEPO_CSP_SCANNER_VERSION` | The plugin | The installed version |
| `CONSEPO_CSP_SCANNER_FILE`, `CONSEPO_CSP_SCANNER_PATH`, `CONSEPO_CSP_SCANNER_URL`, `CONSEPO_CSP_SCANNER_BASENAME` | The plugin | The main file, its directory and URL, and its plugin basename |

`consepo_csp_scanner_version()` returns the installed version, or `0.0.0` when the plugin has not booted.