Find why a resource is blocked, why no header is sent, or why connecting fails.
A resource is blocked
Why is this resource blocked?
Is the policy mode Enforcing?
Does the console mention integrity or a digest?
Is it a script whose tag in the page source has no nonce attribute?
Report-only mode blocks nothing
The console shows what the policy would block. If the resource really fails to load, the cause is elsewhere, for example another plugin’s policy. Check the response headers for a second Content-Security-Policy.
An integrity hash no longer matches
The file changed after it was hashed, or a cached page carries an old hash. Purge the full-page cache, then use Hash again under Integrity. For a remote file that keeps changing, use Never pin.
The script was printed outside the WordPress APIs
With nonces on, a script echoed directly by a theme or plugin has no nonce and is blocked. Enqueue it, or turn nonces off and allow it through the policy.
The policy does not allow the source
Allow the host in Consepo and scan again, or switch the source to Custom and add it to the right directive. Stay in Report-only until the reports are clean.
This answer needs a valid destination.
Edit the block and connect this answer to another question or outcome.
No header is sent
Check Policy → Header. It shows No header is sent. when the mode is Off, or when the source has no policy: no scan has completed yet, or the custom policy is empty. When the preview shows a header but a page does not get it:
- The page is in wp-admin, the login page, a REST response, or the Customizer preview, none of which get the policy.
- Another plugin or the server already sent a header with the same name, and the plugin left it alone.
- Code on the site returns false from
consepo_csp_scanner_send_policy.
Connecting and scanning
| Message | Cause | Fix |
|---|---|---|
| That is not a Consepo API token. Tokens start with csp_ and are 52 characters long. | The pasted value is not a token | Copy the whole token from Consepo |
| Consepo did not accept that credential. Check the token, or reconnect the account. | Consepo answered 401: the token is wrong or revoked | Create a new token and connect again |
| Consepo's 403 message, for example "API access is not available on your current plan", or "Your Consepo plan cannot connect this site, or the token is not for this domain. …" when Consepo gives none | The plan cannot connect the site, or the token's domains do not include it | Use a WordPress plugin token created for this site's domain, on a paid plan |
| Consepo could not be reached: … | The request to Consepo failed | Check the site's outbound HTTPS, then retry |
| "Daily scan limit reached" from Consepo, or "Consepo’s limit for today has been reached. Try again later." | The workspace's daily scan limit | Wait, or raise the plan |
| "Scan is still in progress" from Consepo, or "A scan is already running." | A re-run was asked for while the scan is in progress | Wait for it to finish |
| "Application limit reached" from Consepo | Starting the site's first scan would exceed the plan's applications | Delete an unused application in Consepo, or raise the plan |
| This site has not been scanned yet. | Refresh before any scan | Scan the site first |
| Connect a Consepo account first. | The action needs a connected account | Connect under Account |
| Consepo does not offer account connection yet. Use an API key instead. | Signing in with Consepo is not available | Connect with a token |
| That connection attempt expired or did not start here. Try connecting again. | More than ten minutes passed, or the return did not match the attempt | Sign in again from the Account screen |
Integrity
Check home page fails with "WordPress could not load its own home page to list its assets." when the server cannot request its own home page, which some hosts block. Turn pinning on and browse the site instead: assets are recorded as pages are served.
The meaning of each asset status is in Subresource Integrity.
The admin screen
- "Consepo could not load its dependencies." The plugin was installed from source without
vendor/. Runcomposer installin the plugin directory, or install a release zip. - The plugin will not activate. WordPress refuses to activate it below version 7.0, which the admin screen needs.