Fix · Cloudflare

Fix “Content Security Policy (CSP)” on Cloudflare

Start with: Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self' -- then tighten.

// Transform Rules > Modify Response Header > Set static
// Content-Security-Policy = default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

Verify the fix

Re-run the Content Security Policy (CSP) check after deploying. Test config changes in staging first and keep a rollback: a wrong header can break a site faster than a missing one.

Other stacks: nginx · Apache · Caddy · Express / Node

Scan your site free → Monitor it continuously