Response Headers
Seven CDN headers monitored continuously and scored against a custom compliance rubric — verified live below. A separate daily review workflow is planned.
Pipeline
_headers- CSP, HSTS, XCTO, Referrer-Policy, Permissions-Policy, XFO, COOP on static assets
- Pages Function
/api/headers— same seven on API responses
Header verification
Checking headers…
Current policy · improvement example
Tightening the Content Security Policy
The current policy permits 'unsafe-inline' for scripts and styles. It supports the site's inline theme setup, but weakens CSP protection.
Remediation: Move inline code and styles into external assets, remove the inline allowances from both static and API response policies, then rerun the live header check and test both themes.