SCQCS/_headers at main · kmay89/SCQCS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# Netlify HTTP Headers for scqcs.com
# Security headers that demonstrate we practice what we preach

/*
  # Prevent clickjacking
  X-Frame-Options: DENY

  # Prevent MIME type sniffing
  X-Content-Type-Options: nosniff

  # Control referrer information
  Referrer-Policy: strict-origin-when-cross-origin

  # Permissions Policy - minimal permissions
  Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()

  # Content Security Policy (single source of truth - no meta tag duplicate)
  # All styles are in external files - no unsafe-inline needed
  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; media-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests

  # Strict Transport Security (HSTS)
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

  # Cross-Origin policies
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Embedder-Policy: credentialless
  Cross-Origin-Resource-Policy: same-origin

# Cache static assets aggressively
/*.css
  Cache-Control: public, max-age=31536000, immutable

/*.js
  Cache-Control: public, max-age=31536000, immutable

/assets/*.png
/assets/*.jpeg
/assets/*.jpg
/assets/*.gif
/assets/*.ico
/assets/*.mp4
  Cache-Control: public, max-age=31536000, immutable

/*.webmanifest
  Cache-Control: public, max-age=86400

# Security files should be fresh
/security.txt
  Cache-Control: public, max-age=86400

/.well-known/security.txt
  Cache-Control: public, max-age=86400

/robots.txt
  Cache-Control: public, max-age=86400

/llms.txt
  Cache-Control: public, max-age=86400