ParadiseSoftware

Magento 2.4.7+

CSP Manager: Admin-Controlled Content Security Policy Whitelisting

Image 1 of 4

Magento System menu with CSP Manager under Other Settings, listing Whitelist Rules, CSP Policy Inspector, and Audit Log.

CSP Manager lives under System in Magento Admin, with Whitelist Rules, CSP Policy Inspector, and Audit Log.

Coming soon Install docs

$149

A zip file of the extension will be emailed to you after you purchase.

Adding a new payment provider or analytics tag to your storefront shouldn't require a developer and a deployment. Paradise CSP Manager lets merchants and admins add Content Security Policy whitelist entries right from the Admin panel. No editing csp_whitelist.xml, no code changes.

Create rules for directives like script-src or connect-src, add the hosts, hashes, or schemes they cover, and scope them to all store views or just the ones you need. Three Admin tools make it easy: a Whitelist Rules grid for managing entries, a Policy Inspector showing how your rules merge with existing policy per store view, and an Audit Log tracking every change.

Your existing CSP setup stays untouched. This just adds Admin-managed sources on top, merging cleanly rather than overriding anything. Risky values like 'unsafe-inline' or wildcards are blocked automatically, keeping security decisions where they belong.

The result: new integrations in minutes, not deploy cycles, without compromising the CSP your developers built.

What you get

  • Whitelist Rules grid Add CSP whitelist rules through the Magento Admin panel, and apply each rule to all store views or to specific ones.
  • CSP Policy Inspector See which storefront CSP sources are in use for a store view, including Magento’s built-in ones and the rules you added.
  • Audit Log See who added, edited, or deleted a whitelist rule, and when that change happened.
  • Adds to Magento Your rules are added on top of Magento, so the existing whitelist is not replaced.

What this does not do

  • Admin panel CSP This module is for the storefront. It does not change the Magento Admin panel’s own CSP.
  • Magento’s own rules You can add rules, but you cannot delete whitelist entries that come from Magento or other modules.
  • Report-only vs restrict Magento still controls that setting. This module does not collect CSP violation reports.

What you need

MagentoOpen Source or Adobe Commerce 2.4.7+
PHP8.1+
LicenseA use license. See license terms.
InstallInstall steps

How Magento storefront CSP works

If you want the background on Magento 2.4.7 restrict mode and when an Admin whitelist is the right tool, read the storefront CSP guide.