Fix · Caddy
Fix “CSP strength” on Caddy
Remove 'unsafe-inline'/'unsafe-eval' from script-src (use nonces or hashes), drop wildcards, add object-src 'none' and base-uri 'self'. Roll out with Content-Security-Policy-Report-Only first.
header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"Verify the fix
Re-run the CSP strength check after deploying. Test config changes in staging first and keep a rollback: a wrong header can break a site faster than a missing one.
Other stacks: nginx · Apache · Express / Node · Cloudflare