diff --git a/Caddyfile b/Caddyfile index dec38b9..2f9811c 100644 --- a/Caddyfile +++ b/Caddyfile @@ -54,7 +54,7 @@ # The crawl pass pages get no CSP: their Buy button posts to /crawl/checkout, # which redirects to coinpayportal.com, and form-action 'self' would block it. @notcrawl not path /crawl /crawl/* - header @notcrawl Content-Security-Policy "default-src 'self'; script-src 'self' https://crawlproof.com https://cdn.jsdelivr.net; connect-src 'self' https://crawlproof.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-src 'self' https://crawlproof.com; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" + header @notcrawl Content-Security-Policy "default-src 'self'; script-src 'self' https://crawlproof.com https://cdn.jsdelivr.net; connect-src 'self' https://crawlproof.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://built.indie.pit.world https://pwamart.com; font-src 'self'; frame-src 'self' https://crawlproof.com; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" # Correct content types for machine-readable files. @plain path /robots.txt /llms.txt /llms-full.txt /.well-known/security.txt diff --git a/apps/web/public/index.html b/apps/web/public/index.html index 0c0b4d0..f9d0d34 100644 --- a/apps/web/public/index.html +++ b/apps/web/public/index.html @@ -253,7 +253,7 @@