How to determine CSP for Wordpress
Use the header Content-Security-Policy-Report-Only first (Content-Security-Policy-Report-Only). This will allow you to test the policy and tune it. It works the same as the "regular" CSP header, except policy violations are not blocked, just reported.
You can use the free service https://report-uri.io/ to receive the reports.