# Cloudflare Pages headers — https://developers.cloudflare.com/pages/configuration/headers/
# A request that matches several rules inherits all of them; for a header set by
# more than one rule the more specific (less pervasive) path wins. The catch-all
# `/*` block below is therefore the baseline, and every rule after it overrides
# the baseline for the paths it matches.
#
# No Content-Security-Policy is set on purpose. The pages ship inline <script>
# blocks (the theme bootstrap, the theme toggle, the index stats module) and
# inline <style>/style attributes, and Astro emits no nonce or hash we can pin
# at build time. A CSP here would need 'unsafe-inline' to keep working, which
# buys nothing over the nosniff + frame + referrer + permissions set below.
/*
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: DENY
Permissions-Policy: camera=(), microphone=(), geolocation=()
Cache-Control: public, max-age=0, must-revalidate
# Content-hashed build output: safe to cache forever.
/_astro/*
Cache-Control: public, max-age=31536000, immutable
/fonts/*
Cache-Control: public, max-age=31536000, immutable
/*.woff2
Cache-Control: public, max-age=31536000, immutable
/*.png
Cache-Control: public, max-age=31536000, immutable
/*.svg
Cache-Control: public, max-age=31536000, immutable
# Crawl surfaces stay revalidated so a push is visible on the next request.
/sitemap.xml
Cache-Control: public, max-age=0, must-revalidate
/robots.txt
Cache-Control: public, max-age=0, must-revalidate
