hk2 / csp
Magento 2 module to manage CSP whitelisted URLs
HK2 CSP Whitelisting
HK2 CSP Whitelisting for Magento version 2.3.5 or above includes major URLs such as Cloudflare, Google Analytics, Google Fonts, Fontawesome, AddThis, Googleapis, Facebook Graph, Pinterest, Vimeo, Twitter, TrustPilot, NitroPack/NitroCDN, jsdelivr.net, Tailwind CSS CDN, and ContentSquare
One can disable Magento 2 CSP. However, Disabling results in more possibilities of attacks on the Magento store. (CSP) are a powerful tool to mitigate against Cross Site Scripting (XSS) and related attacks.
Please Note :- This module Whitelist CSP in Magento Store Frontend.
💰 Account & Pricing
This is a Open Source - Free to use Module. No charge or any fee is there to use it.
🧐 Features
- Fully Customizable as per your Store needs. Check How to Configure Section for more details.
- Simple, Open Source & Free
- CSP is not disabled rather specific listed urls are whitelisted, keeping your Magento Store Safe.
Some of the URL Whitelisted
- Addthis (moatads is a part of Addthis)
- Cloudflare
- Facebook Graph
- Fontawesome
- Google Analytics, Google Fonts, Gstatic, Google Tag Manager & Googleapis
- Trust Pilot
- Vimeo
- ContentSqaure
- Nitropack/NitroCDN
- Tailwind
- jsdelivr.net
🚀 Supported Version
- Magento v2.3.5, 2.4.x
How to install
Method 1: Install ready-to-paste package
Download Link - HK2 - CSP - (https://github.com/basantmandal/HK2-CSP/releases/tag/1.0.3)
Download the zip package and unzip it in app/code folder.
Enable Extension
php bin/magento module:enable HK2_Csp
php bin/magento setup:upgrade
php bin/magento cache:flush
Disable Extension
php bin/magento module:disable HK2_Csp
php bin/magentosetup:upgrade
php bin/magento cache:flush
Method 2: Install via composer (Recommend)
Run the following command in Magento 2 root folder
composer require hk2/csp
php bin/magento setup:upgrade
php bin/magento setup:static-content:deploy
How to Configure?
You can add a domain to the whitelist for a policy (like script-src, style-src, font-src and others) by updating the csp_whitelist.xml present in /app/code/HK2/Csp/etc/csp_whitelist.xml . Please only create rules for URLs that you have verified as safe & safe for your Magento Store. Ensure that you use a unique "id" (e.g. the URL) for each entry within its group. Below screenshot describes Policy Name & Description.
[image: screenshot1]
🛠️ Maintenance mode
You may want to enable the maintenance mode when installing or updating the module, especially when working on a production website. To do so, run the two commands below before and after running the other setup commands:
Enable Maintenance Mode
php bin/magento maintenance:enable
Disable Maintenance Mode
php bin/magento maintenance:disable
🤫 Privacy
This extension does not read, change, store, or transmit any of your personal data (e.g., logins, passwords, messages, contacts) from any of the sites or your computer in absolutely any form.
📫 Support
For support or any bug report or changes mail me at - [email protected]
🐞 Bug Report
Please open an issue on GitHub.
When filing a bug remember that the better written the bug is, the more likely it is to be fixed.
You can also reach us at [email protected]
🍰 Contribution Guidelines 💖
Contributions are welcome! If you’d like to contribute to this project:
- Fork the repository.
- Create a new branch (git checkout -b feature/your-feature-name).
- Make your changes and commit them (git commit -am 'Add new feature').
- Push to the branch (git push origin feature/your-feature-name).
- Open a pull request.
Please Note :- I may be a bit delayed in responding or slow in responding due to low amount of free time. I apologize for the inconvenience and I appreciate your patience
📜 License
Copyright (c) 2022, 2025 Basant Mandal (HK2 - Hash Tag Kitto)
🤝 Consent
By using HK2 CSP Whitelisting Module, you hereby consent to our disclaimer and agree to its terms.
📢 Disclaimer
Basant Mandal (HK2 - Hash Tag Kitto) does not make any warranties about the completeness, reliability and accuracy of this image or its related products. Any action you take upon the information you find here is strictly at your own risk.
Basant Mandal (HK2 - Hash Tag Kitto) will not be liable for any losses and/or damages in connection with the use of our website.
💖Like my work? Help Us
Please rate my project or give some stars at https://github.com/basantmandal/HK2-CSP. You can also contribute to make my Open Source Contribution more frequent and help others - https://www.buymeacoffee.com/basantmandal or https://www.basantmandal.in/buymecoffee
📫 Feedback
If you have any feedback, please reach out to us at [email protected]
🛡️ License
🔗 Links
v1.0.3 - 25-December-2024
(*) Updated CSP Whitelists (Added NitroPack/NitroCDN & jsdelivr.net & Tailwind CSS CDN, Etc)
v1.0.2 - 15-July-2023
(*) Updated CSP Whitelists (Added ContentSquare URL)
v1.0.0 - 14-June-2022
(*) Initial Release
| Version | Stability | QA Status | Compatibility | Released |
|---|---|---|---|---|
| v2.1.0 | stable | Not tested | Not yet tested Details | 2026-07-16 15:40:32 |
| v2.0.0 | stable | Not tested | Not yet tested Details | 2026-07-16 15:36:30 |
| 1.0.3 | stable | Fail | Magento 2.4.7-2.4.9 Details | 2024-12-25 13:11:02 |
| 1.0.2 | stable | Not tested | Not yet tested Details | 2023-07-15 12:12:07 |
| 1.0.0 | stable | Not tested | Not yet tested Details | 2022-06-16 05:29:15 |
Requires 2
| Package | Constraint |
|---|---|
| magento/framework | >=100.0.0 |
| php | ^7.3.0|^7.4.0|^8.0|^8.1.0|^8.2.0 |
Compatibility
Each Magento release line is installed on its supported PHP versions, then the module is built (DI compilation + static-content deploy) and its unit and integration suites are run. The matrix shows the lines and PHP versions the module is confirmed to install and run on. Code-quality results further down (phpstan, phpcs, …) are reported separately and never affect compatibility.
Code Quality
Advisory checks against the module's source. Static analysis runs once across the whole module; PHPStan re-runs per Magento + PHP version because resolvable symbols differ between releases. These NEVER affect the Compatibility badge. A phpcs finding can't make a module incompatible.
Static analysis
Coding standards (phpcs), mess detection (phpmd), copy-pasted code (cpd), PHP cross-version compatibility, composer.json validity. Each runs once for the whole module.
Tests
Unit and integration suites, run for each applicable Magento and PHP version. A test failure speaks to the module's behaviour, not its compatibility with a Magento line, so it is reported here separately and never reddens the compatibility matrix.
Unit tests
| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | N/A | N/A | ||
| 2.4.8 | N/A | N/A | ||
| 2.4.9 | N/A | N/A |
Integration tests
| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | N/A | N/A | ||
| 2.4.8 | N/A | N/A | ||
| 2.4.9 | N/A | N/A |
Security
Security checks run directly against the module: an audit of its declared dependencies for known vulnerabilities (composer audit) and a scan of its source for malware and web-shell signatures. Each runs once. A malware detection fails the version outright.
More from hk2
View vendorMagento 2 Marketing Analytics: Google Analytics, Facebook Pixel, Product Feed & Conversion Tracking
HK2 Core module - The foundational base module for all Magento 2 HK2 extensions.
Sanitizes Magento storefront search queries by removing suspicious SQL-related keywords and characters.
Turn an existing module into recurring revenue.
If you already maintain a Magento 2 module on GitHub or GitLab, listing it on Packagento takes about five minutes. We mirror your tags, handle distribution signing, and route paid licenses through Stripe Connect, so you can keep shipping the way you already do.