Repository navigation
Expand file tree
/
Copy path_headers
More file actions
78 lines (60 loc) · 2.69 KB
/
Copy path_headers
File metadata and controls
78 lines (60 loc) · 2.69 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# Cloudflare Pages _headers
# Rules are evaluated top-to-bottom; first match per header wins.
# Reference: https://developers.cloudflare.com/pages/configuration/headers/
# Assets are noindex (they should not appear in search results on their own).
/resources/*
X-Robots-Tag: noindex, nofollow, noarchive
# Public icons & social previews are intentionally cross-origin-readable.
/favicon.ico
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Cache-Control: public, max-age=2592000
/*/favicon.ico
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Cache-Control: public, max-age=2592000
/*/favicon.png
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Cache-Control: public, max-age=2592000
/*.opengraph.jpg
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Cache-Control: public, max-age=2592000
# Long-lived caching for binary static assets.
/*.svg
Cache-Control: public, max-age=2592000
/*.webp
Cache-Control: public, max-age=2592000
/*.avif
Cache-Control: public, max-age=2592000
/*.jpg
Cache-Control: public, max-age=2592000
/*.png
Cache-Control: public, max-age=2592000
/*.mp4
Cache-Control: public, max-age=2592000
/*.webm
Cache-Control: public, max-age=2592000
/*.css
Cache-Control: public, max-age=2592000
/*.woff
Cache-Control: public, max-age=31536000, immutable
/*.woff2
Cache-Control: public, max-age=31536000, immutable
# HTML pages: revalidate on every request but allow conditional 304.
/*.html
Cache-Control: public, max-age=0, must-revalidate
# Sitemap.
/sitemap.xml
Cache-Control: public, max-age=3600, must-revalidate
# Site-wide defaults
/*
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Content-Security-Policy: default-src 'none'; base-uri 'self'; img-src 'self' data:; media-src 'self' data:; script-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests
Permissions-Policy: accelerometer=(), autoplay=(self), camera=(), clipboard-read=(), clipboard-write=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), serial=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()