Caddy

Caddy CSP Setup Guide

Prerequisites

Caddy 2.x or later
Access to your Caddyfile
A CSP Warden account with a verified domain
Your domain reporting token (found in your CSP Warden dashboard)

Add CSP Header (Report-Only Mode)

Use Caddy's built-in header directive to set the CSP Report-Only header in your Caddyfile:

caddyfile

yourdomain.com {
    # CSP Report-Only - monitors without blocking
    header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
    # Companion header: maps the "csp-endpoint" group named by report-to to your report URL
    header Reporting-Endpoints `csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"`

    # Your existing directives
    reverse_proxy localhost:8080
}

Ship both headers together: report-to names a reporting group (csp-endpoint), and the Reporting-Endpoints header maps that name to the actual HTTPS URL. The legacy report-uri keeps older browsers working.

Apply to Specific Paths (Optional)

If you only want CSP on certain paths, use a handle block:

caddyfile

yourdomain.com {
    handle /app/* {
        header Content-Security-Policy-Report-Only "default-src 'self'; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
        header Reporting-Endpoints `csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"`
        reverse_proxy localhost:8080
    }

    handle {
        root * /var/www/html
        file_server
    }
}

Switch to Enforcement Mode

After reviewing violations in your CSP Warden dashboard, change the header name fromContent-Security-Policy-Report-Only toContent-Security-Policy:

caddyfile

yourdomain.com {
    # Enforce CSP - blocks violating resources and reports
    header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
    header Reporting-Endpoints `csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"`

    reverse_proxy localhost:8080
}

Reload Caddy

Apply your changes:

bash

sudo systemctl reload caddy

Or if using the Caddy CLI:

bash

caddy reload --config /etc/caddy/Caddyfile

Troubleshooting

Header not appearing: Ensure the header directive is placed before reverse_proxy in your Caddyfile.
Caddy not reloading: Check for syntax errors with caddy validate --config /etc/caddy/Caddyfile.
Duplicate headers: If your upstream app also sets CSP headers, use header -Content-Security-Policy to remove the upstream header before setting your own.

yourdomain.com { # CSP Report-Only - monitors without blocking header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" # Companion header: maps the "csp-endpoint" group named by report-to to your report URL header Reporting-Endpoints `csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"` # Your existing directives reverse_proxy localhost:8080 }

yourdomain.com { handle /app/* { header Content-Security-Policy-Report-Only "default-src 'self'; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" header Reporting-Endpoints `csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"` reverse_proxy localhost:8080 } handle { root * /var/www/html file_server } }

yourdomain.com { # Enforce CSP - blocks violating resources and reports header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" header Reporting-Endpoints `csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"` reverse_proxy localhost:8080 }

Troubleshooting

Header not appearing: Ensure the header directive is placed before reverse_proxy in your Caddyfile.
Caddy not reloading: Check for syntax errors with caddy validate --config /etc/caddy/Caddyfile.
Duplicate headers: If your upstream app also sets CSP headers, use header -Content-Security-Policy to remove the upstream header before setting your own.