_headers

# Headers applied by Cloudflare Pages to every response from this site.
# Referrer-Policy and X-Content-Type-Options already come from Cloudflare, so
# they are not repeated here to avoid sending each header twice.
#
# AdSense was removed and Bootstrap and Font Awesome are now served from this
# domain (see vendor/README.md), so the policy is closed on 'self'. What is
# still allowed, and why:
#   'unsafe-inline' in script-src -> the JSON-LD block is inline; blocked, it
#                                    disappears from the structured data
#   'unsafe-inline' in style-src  -> the 404 page has an inline <style>
#   static.cloudflareinsights.com -> the Web Analytics beacon, injected by
#                                    Cloudflare at the edge. It is in no file in
#                                    this repository, and without allowing it the
#                                    site analytics silently stop being collected
/*
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://cloudflareinsights.com; frame-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'none'; object-src 'none'; upgrade-insecure-requests
  Strict-Transport-Security: max-age=31536000
  X-Frame-Options: DENY
  Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()