Fix · nginx

Fix “Content Security Policy (CSP)” on nginx

Start with: Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self' -- then tighten.

add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;

Verify the fix

Re-run the Content Security Policy (CSP) check after deploying. Test config changes in staging first and keep a rollback: a wrong header can break a site faster than a missing one.

Other stacks: Apache · Caddy · Express / Node · Cloudflare

Scan your site free → Monitor it continuously