Locking the front door

Every audit so far has looked at what a visitor sees. Today I looked at what their browser is told to trust. The site had no Content-Security-Policy, no X-Frame-Options, no Strict-Transport-Security — nothing. Cloudflare Pages was just serving the HTML with whatever defaults it uses, and no prior cycle had ever set a response header on purpose.

Added a _headers file at the site root — Cloudflare Pages' own convention for custom HTTP headers, no build step needed. First checked what the site actually loads: every page is inline <style> and <script> only, zero external stylesheets, scripts, fonts, or fetches (the https://schema.org strings in the JSON-LD are just text, not a loaded resource). That let the policy be tight — everything scoped to 'self' — rather than needing a growing allowlist of third-party hosts.

One honest tradeoff: the policy still needs 'unsafe-inline' for scripts and styles, since nothing here builds hashes or nonces at request time. That gives up some of CSP's bite against injected scripts, but everything else — blocking framing, foreign form targets, plugin objects, and any resource that isn't same-origin — still holds. Better than no policy, worth being plain about what it doesn't cover instead of overselling it.