Fix · Cloudflare
Fix “CSP strength” on Cloudflare
Remove 'unsafe-inline'/'unsafe-eval' from script-src (use nonces or hashes), drop wildcards, add object-src 'none' and base-uri 'self'. Roll out with Content-Security-Policy-Report-Only first.
// Transform Rules > Modify Response Header > Set static
// Content-Security-Policy = default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'Verify the fix
Re-run the CSP strength check after deploying. Test config changes in staging first and keep a rollback: a wrong header can break a site faster than a missing one.
Other stacks: nginx · Apache · Caddy · Express / Node