You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
59 lines
3.4 KiB
59 lines
3.4 KiB
# Paste the below in https://play.netlify.com/headers to test |
|
# Set max-age to 1 year for stuff not expected to update any time soon. |
|
/css/* |
|
Cache-Control: public, max-age=31536000 |
|
|
|
/js/* |
|
Cache-Control: public, max-age=31536000 |
|
|
|
/fonts/* |
|
Cache-Control: public, max-age=31536000 |
|
|
|
# Favicons |
|
/favicon.* |
|
Cache-Control: public, max-age=31536000 |
|
/favicon-*.png |
|
Cache-Control: public, max-age=31536000 |
|
/mstile-*.png |
|
Cache-Control: public, max-age=31536000 |
|
/apple-touch-icon.png |
|
Cache-Control: public, max-age=31536000 |
|
/manifest.json |
|
Cache-Control: public, max-age=31536000 |
|
|
|
# Also these images used by the refined theme won't be updated frequently. |
|
/images/* |
|
Cache-Control: public, max-age=31536000 |
|
|
|
# https://webbkoll.dataskydd.net/en/results?url=https%3A%2F%2Fscripter.co%2F |
|
# Security Headers: https://securityheaders.com/?q=https%3A%2F%2Fscripter.co&followRedirects=on |
|
|
|
## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy |
|
/* |
|
Referrer-Policy: same-origin |
|
|
|
## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options |
|
# I never intend to show any of the pages on my site in a <frame> on my site or |
|
# elsewhere. |
|
/* |
|
X-Frame-Options: DENY |
|
|
|
## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection |
|
/* |
|
X-Xss-Protection: 1; mode=block |
|
|
|
## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options |
|
/* |
|
X-Content-Type-Options: nosniff |
|
|
|
# Content Security Policy |
|
## Hashes for Privacy Badger injected scripts: https://gitlab.com/kaushalmodi/kaushalmodi.gitlab.io/blob/29fc983ac72fa886ac39bff6b46dc7e426cb993b/netlify.toml#L174-199 |
|
/* |
|
Content-Security-Policy: default-src 'none'; script-src 'self' 'sha256-O+U/ptNNoUqEhNU1BSkb7izMavM1GxrvRrabNX8WTKE=' 'sha256-YiWMVJIplziLxmHOI6iqs51JQS9W2hg1wDsKBD3u09g=' 'sha256-Zgc2pp+yOmAVogxvTHYBMFKubY0HKk2a0+0+8sX17WY=' 'sha256-kNsowQfHpWMrbQG7AtSzSuMQg2t/YKwmDWdqeKfm4BI=' 'sha256-afSIEhWGAPlY458Q4YkhPLVnsVEBh/u5YNlpg6od8TU=' https://cdnjs.cloudflare.com/ajax/libs/mathjax/ https://cdn.jsdelivr.net/npm/mathjax@3/ https://d33wubrfki0l68.cloudfront.net/js/ https://cdn.datatables.net 'unsafe-inline'; object-src 'none'; style-src 'self' https://d33wubrfki0l68.cloudfront.net https://cdn.rawgit.com/kaushalmodi/iosevka-mirror/ https://cdn.datatables.net 'unsafe-inline'; img-src 'self' https://d33wubrfki0l68.cloudfront.net https://api.travis-ci.org/kaushalmodi/ https://cdn.datatables.net; font-src https://cdn.jsdelivr.net/npm/mathjax@3/ 'self' about: data: https://cdnjs.cloudflare.com/ajax/libs/mathjax/ https://cdn.rawgit.com/kaushalmodi/iosevka-mirror/; connect-src 'self'; manifest-src 'self'; media-src 'self'; frame-src https://ghbtns.com https://www.youtube-nocookie.com; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; block-all-mixed-content; report-uri https://c571407e2c6d71ed2021633b7fdad0de.report-uri.com/r/d/csp/enforce; |
|
|
|
# Feature Policy |
|
## https://github.com/WICG/feature-policy/blob/master/features.md |
|
## https://scotthelme.co.uk/a-new-security-header-feature-policy/ |
|
## https://developers.google.com/web/updates/2018/06/feature-policy |
|
/* |
|
Feature-Policy: accelerometer 'none' ; ambient-light-sensor 'none' ; autoplay 'self' ; camera 'none' ; encrypted-media 'none' ; fullscreen 'self' ; geolocation 'none' ; gyroscope 'none' ; magnetometer 'none' ; microphone 'none' ; midi 'none' ; payment 'none' ; picture-in-picture * ; speaker 'none' ; sync-xhr 'none' ; usb 'none' ; vr 'none'
|
|
|