Fix · Caddy

Fix “Content Security Policy (CSP)” on Caddy

Start with: Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self' -- then tighten.

header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"

Verify the fix

Re-run the Content Security Policy (CSP) check after deploying. Test config changes in staging first and keep a rollback: a wrong header can break a site faster than a missing one.

Other stacks: nginx · Apache · Express / Node · Cloudflare

Scan your site free → Monitor it continuously