I have the following Content-Security-Policy in my htaccess that worked fine until 5 hours ago:

Header always set Content-Security-Policy "frame-src 'self' js.stripe.com; object-src 'none'; frame-ancestors 'none';"

Suddenly, a page without any reference to stripe or any hidden stripe file download started giving the following error message in the Console:

Refused to frame because it violates the following Content Security
Policy directive: “frame-src ‘self’ js.stripe.com”.

I checked and rechecked, there’s no mention of Stripe in my code. What’s happening?