msayson.github.io/_headers at main · msayson/msayson.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
/*
  # This file defines headers that will be enforced by CloudFlare Pages
  # Ref: https://developers.cloudflare.com/pages/configuration/headers/

  # Reject incorrect MIME types (XSS mitigation)
  X-Content-Type-Options: nosniff

  # Prevent clickjacking
  X-Frame-Options: DENY

  # Controls how much referrer information is sent with requests
  Referrer-Policy: strict-origin-when-cross-origin

  # Enforce HTTPS (HSTS)
  Strict-Transport-Security: max-age=31536000

  # Allow-list only self-hosted content and Google Analytics
  Content-Security-Policy: default-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.google-analytics.com https://static.cloudflareinsights.com; connect-src 'self' https://www.google-analytics.com https://analytics.google.com https://region1.google-analytics.com https://cloudflareinsights.com; font-src 'self';

  # Blocks access to hardware and sensitive browser APIs
  Permissions-Policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), hid=(), magnetometer=(), microphone=(), serial=(), usb=()