default-src ‘self’; img-src *; media-src * data:;

Please, post a link to the page with this issue and let me know what do you have in your Base Rules’ tab.

This plugin has a function to reduce img-src to * if the CSP policy header generated is too long (see: https://github.com/MocioF/No-unsafe-inline/blob/2aa46f952220aba9648dac86bf092d7a86a8bcd4/public/class-no-unsafe-inline-public.php#L400), but I think you are deploying a CSP with another mechanism or plugin.

This site is internal, so cannot show it.

• This reply was modified 1 month, 1 week ago by fuzzy21.

Sorry @fuzzy21, but this plugin does never deploy the x-content-security-policy HTTP header, but only the Content-Security-Policy or the Content-Security-Policy-Report-Only headers.

I found another csp plugin that I was testing, sorry for the noise.