# Security headers for Cloudflare Pages.
# Place this file in your build output folder so it is deployed with the site.
# The CSP is report-only. Rename it to Content-Security-Policy once the console is quiet.
# Add your payment, analytics and database domains to the CSP before enforcing it.

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), usb=()
  Cross-Origin-Opener-Policy: same-origin
  Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-src 'none'; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests

# Long cache for fingerprinted build assets. Adjust the path to match your build tool.
/assets/*
  Cache-Control: public, max-age=31536000, immutable
