title: wordpress and CSP
body: <p>Did anyone stumble upon trying to secure headers (CSP) in wordpress with several plugins spitting js in the dom?</p>
  
  <p>I am trying to enhance the headers with CSP and remove the 'unsafe-inline' in the script-src directive.</p>
  
  <p>Some static js I was able to load them with hashes, but when comes to dynamic, it becomes cumbersome. I overwrote some of the functions that spit js to contain a nonce and added the nonce in the CSP, but every time someone adds a plugin that behaves like this or updates a modified plugin, i will have to redo it thus this way is not very robust.</p>
  
  <p>Does anybody have some ideas other than allowing the inline and never update plugins?</p>
  
  <p>Best</p>