Critical-risk tools in Caddy
3 of the 18 tools in Caddy are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
caddy_config_deleteDestructiveDelete config at a JSON path. Removes the config node at the specified path. Deleting a parent node also deletes every descendant -- e.g. deleting
-
caddy_remove_routeDestructiveRemove a route. Target by @id (preferred — stable across reorderings) or by array index on a specific server. Index-based removal is a two-step read-then-delete and can race aga...
-
caddy_loadDestructiveReplace the entire Caddy configuration atomically. Accepts a JSON config object, or a Caddyfile string with format=
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.