ModKor CSP for Magento 2 & Hyva

What it does

ModKor CSP manages your store’s Content Security Policy — the browser rule-set that decides which third-party scripts, frames and connections are allowed. Instead of editing files, it learns from real violations and lets you approve them with one click.

Where to find it

Admin → ModKor → CSP → Dashboard (also mirrored under Stores → ModKor → CSP).

First-time setup (5 minutes)

1. Open the dashboard and leave Policy mode = Report-only — nothing is blocked in this mode.
2. Set Enable = On and Save.
3. (Optional) Click Apply baseline to pre-allow the services almost every store uses.
4. Browse your storefront — each blocked third-party script is recorded.
5. Return to the dashboard; open violations appear under Suggestions.

Approving suggestions

• Green “Recommended” = a known vendor → Approve adds every host it needs.
• Amber = a specific unknown host → review, then Approve if you use it.
• Red = high-risk (inline / data: / wildcard) → allow only if you understand why.
• Ignore dismisses a suggestion without whitelisting it.

Adding entries manually

Use Add to whitelist: pick a known service (adds the full bundle automatically) or enter a custom host against a directive — script-src for JavaScript, style-src for CSS, img-src for images, connect-src for XHR/fetch, frame-src for iframes, font-src for fonts.

Your active whitelist

Everything currently allowed is listed by directive under Active whitelist. Remove any host with the × button.

Going live (Enforce)

When the suggestions list is clear, switch Policy mode = Enforce and Save. Reports keep being collected, so a new integration later shows up as a new suggestion.

Multi-store

Use the Scope selector at the top; tick “Override for this store view” on a section to give it its own settings, or leave it to inherit from Default.

Monitoring

The Violations panel tracks how many suggestions are open, whitelisted and ignored, with a link to the full violation log.