No unsafe-inline helps you to build a Content Security Policy avoiding to use 'unsafe-inline' and 'unsafe-hashes'.
As of April 2026, No unsafe-inline is a WordPress csp plugin with 200 active installations and a 5/5 rating from 5 reviews. It has been downloaded 11K+ times in total. Requires WordPress 5.9+ and PHP 7.4+. Available on WordPress.org since 2022. Support resolution rate: 0%. Top alternative: Headers Security Advanced & HSTS WP.
Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context.
Cross-site scripting (XSS) is a type of security vulnerability that can be found in some web applications.
XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users.
A cross-site scripting vulnerability may be used by attackers to bypass access controls like the same-origin policy.
Looking at National Vulnerability Database run by US NIST, more than 1100 (November 2025) vulnerabilities are reported as XSS for WordPress’ plugins and themes.
Keeping your site up-to-date with the latest versions of plugins and theme…
| WordPress | 5.9+ requiredTested up to 6.9.4 |
| PHP | 7.4+ required |
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.