-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path_headers
More file actions
40 lines (36 loc) · 2.62 KB
/
Copy path_headers
File metadata and controls
40 lines (36 loc) · 2.62 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# Netlify / Cloudflare Pages header syntax. GitHub Pages ignores this file, so
# none of it is enforced on the current apex deployment: it is kept correct so
# that moving the site behind Cloudflare Pages does not silently break checkout
# or booking.
#
# CSP third-party allowances, and why each is required:
# js.stripe.com : Stripe buy-button script on /pricing
# assets.calendly.com : Calendly inline embed loader
# calendly.com : the Calendly booking iframe itself (frame-src)
# fonts.googleapis.com / fonts.gstatic.com : webfont CSS + font files
# The previous policy allowed only 'self' plus one inline hash, which would have
# blocked the Stripe button and the Calendly widget outright.
#
# frame-src must be stated explicitly: it falls back to default-src ('self'),
# so without it the Calendly and Stripe iframes are refused.
/*
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Frame-Options: DENY
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: same-origin
X-Permitted-Cross-Domain-Policies: none
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(self), camera=(), clipboard-read=(), clipboard-write=(self), document-domain=(), encrypted-media=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(self), usb=(), xr-spatial-tracking=()
Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests; manifest-src 'self'; worker-src 'self' blob:; script-src 'self' 'sha256-mDfvlEEbZ+pOz33Aj7pRtcA8xcbmfe1wOO1NaObDVDs=' https://js.stripe.com https://assets.calendly.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.calendly.com; img-src 'self' data: https://files.stripe.com; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://api.stripe.com https://js.stripe.com https://api.calendly.com https://calendly.com https://pypi.org; frame-src https://js.stripe.com https://checkout.stripe.com https://hooks.stripe.com https://calendly.com; frame-ancestors 'none'; form-action 'self' https://buy.stripe.com https://checkout.stripe.com https://billing.stripe.com; media-src 'self' blob:
Cache-Control: public, max-age=0, must-revalidate
/assets/*
Cache-Control: public, max-age=31536000, immutable
/videos/*
Cache-Control: public, max-age=31536000, immutable
/.well-known/*
Cache-Control: public, max-age=0, must-revalidate