Information security is often a race against cybercriminals. “Script kiddies” and more professional malicious actors relentlessly scan the internet using bot armies as weapons to find vulnerable targets: routers, printers, web servers, and refrigerators. The type of target does not matter, anything goes.
When a botnet finds a suitable target, an automated search for security vulnerabilities follows: various inputs are sent to the target systems to force the system into returning sensitive data or altering its operation according to the attacker’s wishes.
Security and WordPress: What is XSS?
For WordPress sites, attackers usually focus on digging up weak passwords and vulnerable plugins. One of the most common types of vulnerabilities is Cross-Site Scripting, or XSS (Wikipedia). In practice, this is a situation where a user succeeds in injecting code of their choice into a page, for example through a contact form embedded on the website.
This vulnerability type is included in resources like the OWASP Top 10, an up-to-date list of the most critical security risks affecting web services.
Content Security Policy (CSP) Prevents Site Hijacking
A small error in a site’s code can lead to the site being hijacked. So, what can help? One method is Content Security Policy (CSP), a security standard and technique where a website tells the visitor’s web browser which resources are permitted on that specific site. On the other hand, it can also instruct the browser to report security anomalies in the embedded content. The goal of CSP is to restrict the inclusion of external code and other components on the site, thereby preventing attacks such as Cross-Site Scripting and clickjacking.
A prerequisite for using CSP is that the visitor uses a modern web browser (Chrome 25+, Edge 14+, Firefox 23+, IE 10+, Opera 15+, Safari 7+).
Information about allowed resources is transmitted from the server to the browser as an HTTP header named Content-Security-Policy. It allows defining allowed sources for elements such as scripts, stylesheets, embedded fonts, frames, and other content types.
A CSP rule can allow either individual files, entire domains, or protocols. A complete HTTP header can look like the following (the content in this example is formatted for easier readability; a more detailed technical description can be found in Mozilla’s developer documentation):
content-security-policy:
default-src 'self';
script-src 'self' https://www.google-analytics.com https://code.jquery.com https://www.gstatic.com https://www.google.com/recaptcha/api.js https://v2.zopim.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.googletagmanager.com;
style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:;
font-src 'self' data: https://fonts.gstatic.com https://use.fontawesome.com https://v2.zopim.com/widget/fonts/zopim.ttf https://*.bootstrapcdn.com;
frame-src https://www.slideshare.net https://www.google.com https://platform.twitter.com https://syndication.twitter.com https://www.youtube.com;
connect-src 'self' wss://*.zopim.com;
upgrade-insecure-requests;
report-uri https://seravo-cspreports.seravo.fi/receive.php;
CSP is Header Data
In practice, implementing CSP means adding more HTTP headers to your site. These headers might tell the user’s browser, for example: “You may only read scripts from servers A and B, stylesheets from servers A and C, and images from servers A, B, and D.”
This way, the browser will refuse to open any other resources, meaning malicious JavaScript injected by an attacker will fail to execute. If the site attempts to serve other resources, the browser can report this to the site’s administrator, who can take immediate action against the attacker.
Implementing CSP
Implementing a Content Security Policy for your website is a multi-step process, and it is important to ensure that the impact of the technology on things like introducing new features is considered throughout development. It is crucial to actively monitor the reports generated by the feature to detect possible anomalies. An incorrect implementation can easily mean a broken website.
WordPress brings an additional challenge to deploying this technology, as at the time of writing, there are still a few known factors in its core that reduce compatibility with CSP.
However, when used correctly, CSP adds significant protection against attack attempts and can act as a lifesaver when a breach attempt hits your site. If you are interested in implementing this technology, a good way to get started is to consult the developer documentation on the subject by the Mozilla Foundation, developers of the Firefox browser.