Set object-src to 'none' on Cloudflare

Why it matters

Without a restrictive object-src, object and embed tags can load content from any source. Hardly any site still needs plugins, so blocking them is usually free.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: check for object or embed tags on your pages (PDF viewers use them).
2. Stage 2: open Rules, Overview, edit the Response Header Transform Rule that sets Content-Security-Policy and append ; object-src 'none' to its value. If the origin sets the policy, change it there.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove 'unsafe-eval' from script-src
• Remove wildcard sources from script-src
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax