Description: Defines allowed font sources for CSP (Pro). How it works: builder_font_src and builder_font_mode control allowed origins for fonts. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Font settings. Add required domains and Save Changes. Recommended setting: If using Google Fonts, allow only the needed domains; otherwise keep to 'self'.

Description: Defines allowed image sources for CSP (Pro). How it works: builder_img_src and builder_img_mode define allowed origins for images; helps prevent data exfil via image beacons. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Image settings. Add required domains and Save Changes. Recommended setting: Allow 'self' and your media/CDN domains; avoid allowing all.

Description: Defines allowed style sources for CSP (Pro). How it works: builder_style_src and builder_style_mode define allowed origins for stylesheets. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Open Style settings. Add required domains and Save Changes. Recommended setting: Keep to 'self' + required CDN domains only.

Allow Inline CSS in CSP

Description: Allows or blocks inline CSS (unsafe-inline) in CSP (Pro). How it works: builder_allow_inline_css controls whether inline styles are permitted; disabling reduces injection risk but may require theme adjustments. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Toggle “Allow inline CSS”. Save and test layout. Recommended setting: Prefer OFF if possible; otherwise keep ON but restrict other directives tightly.

Allow Inline JavaScript in CSP

Description: Allows or blocks inline JS (unsafe-inline) in CSP (Pro). How it works: builder_allow_inline_js controls whether inline scripts are permitted; disallowing improves security but may break some themes/plugins. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Toggle “Allow inline JS”. Save and test site functionality. Recommended setting: Prefer OFF; only enable if required and plan to migrate to nonces/hashes later.

Description: Controls whether CSP is built from presets, custom lists, or a guided builder (Pro). How it works: builder_mode defines how directives are assembled, which sources are included, and whether extra directives are appended. How to access / configure: WP Admin → AegisShield → Security Headers → CSP Builder. Select Builder Mode. Save changes. Recommended setting: Use the guided builder first; move to custom directives only if you understand CSP well.

Content Security Policy (CSP) Levels

Description: Controls how strict CSP is applied across frontend/admin (Pro features may be dimmed in UI). How it works: csp_level, csp_level_frontend, and csp_level_admin determine whether CSP is off, report-only, balanced, strict, or custom. How to access / configure: WP Admin → AegisShield → Security Headers → CSP. Choose CSP level for frontend and admin. Save changes and test critical pages. Recommended setting: Start with Report-Only (Pro) to collect violations, then move to Balanced/Strict after tuning.

HTTP Strict Transport Security (HSTS)

Description: Forces browsers to use HTTPS for your site, reducing downgrade and cookie hijacking risks. How it works: When enable_hsts is on, AegisShield sends the Strict-Transport-Security header so browsers remember to use HTTPS. How to access / configure: WP Admin → AegisShield → Security Headers. Enable HSTS. Confirm your site is fully HTTPS first, then Save Changes. Recommended setting: Enable only after confirming HTTPS is permanent and working across all subpages.

Enable Security Headers

Description: Master switch for applying configured security headers. How it works: The sec_headers enabled setting controls whether AegisShield injects headers on outgoing responses. How to access / configure: WP Admin → AegisShield → Security Headers. Toggle “Enabled”. Save changes. Recommended setting: Enable in production; disable temporarily only for debugging header conflicts.

Basic Header Management

Description: Adds key HTTP security headers to reduce browser-based attacks. How it works: Security Headers applies configured headers on responses and helps prevent clickjacking, MIME sniffing, and referrer leakage. How to access / configure: WP Admin → AegisShield → Security Headers. Enable Security Headers. Save changes and test your site in an incognito window. Recommended setting: Enable on all sites; start with a balanced profile before moving to strict CSP.

News & Events

Categories: AegisShield
CSP Font Sources
read more
Categories: AegisShield
CSP Image Sources
read more
Categories: AegisShield
CSP Style Sources
read more
Categories: AegisShield
Allow Inline CSS in CSP
read more
Categories: AegisShield
Allow Inline JavaScript in CSP
read more
Categories: AegisShield
CSP Builder Mode
read more
Categories: AegisShield
Content Security Policy (CSP) Levels
read more
Categories: AegisShield
HTTP Strict Transport Security (HSTS)
read more
Categories: AegisShield
Enable Security Headers
read more
Categories: AegisShield
Basic Header Management
read more

keep updated & don’t miss anything!

We regularly develop new plugins and release them for free because they’re solutions we trust and use ourselves.

By entering your email, you agreed to our Privacy Policy and Terms & Conditions

Frequently Asked Questions

Support Docs

Ticketing System

font builder allowed csp fonts domains description defines sources pro works src mode control origins access configure admin aegisshield security headers open settings add required save changes recommended setting using google allow needed otherwise keep self

Powered by Aegisify Links

2026 - Aegisify.com - Everything Your WordPress Site Needs, One Platform. One Price.

Privacy Policy * Terms of Use * Free Plugin Disclaimer * End User License Agreement