Set privacy and security HTTP headers #49

New issue

Open

opened 2026-07-01 01:02:27 +00:00 by manlycucumber · 0 comments

manlycucumber commented

2026-07-01 01:02:27 +00:00

(Migrated from github.com)

Problem

The public site should ship hardened headers (CSP, referrer policy, etc.) consistent with its no-tracker posture.

Acceptance criteria

A Content-Security-Policy restricts scripts/styles to first-party (and explicitly allowed) origins
Referrer-Policy, X-Content-Type-Options, and frame protections are set
The CSP does not permit third-party tracking domains
Headers are verified on representative public pages

## Problem The public site should ship hardened headers (CSP, referrer policy, etc.) consistent with its no-tracker posture. ## Acceptance criteria - [ ] A Content-Security-Policy restricts scripts/styles to first-party (and explicitly allowed) origins - [ ] Referrer-Policy, X-Content-Type-Options, and frame protections are set - [ ] The CSP does not permit third-party tracking domains - [ ] Headers are verified on representative public pages

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Site#49

No description provided.

Rows
Columns