netlify.toml

# Use this file as your netlify.toml file
# client side route redirects are auto
# generated.

# Header configuration

[[headers]]
  for = "/*"
  [headers.values]
    # Prevents the site from being framed by other sites, protecting against clickjacking.
    X-Frame-Options = "DENY"
    # Explicitly disabled: this header is deprecated and non-standard, and can itself introduce XSS vulnerabilities. The Content-Security-Policy below is the actual XSS defense.
    X-XSS-Protection = "0"
    # Ensures that only trusted content is executed and styled.
    Content-Security-Policy = "default-src 'self'; script-src 'self' blob: 'unsafe-inline' https://cardano.org https://developers.cardano.org https://www.googletagmanager.com https://js.hsforms.net https://js-eu1.hsforms.net https://forms.hsforms.com https://www.google.com https://www.gstatic.com; img-src 'self' https://cardano.org https://developers.cardano.org https://forms.hsforms.com https://forms-eu1.hsforms.com data: https://*.ytimg.com; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://*.hsforms.net; media-src 'self' https://www.youtube.com https://www.youtube-nocookie.com; connect-src 'self' https://*.algolia.net https://*.algolianet.com https://hubspot-forms-static-embed.s3.amazonaws.com https://*.hsforms.com https://*.google-analytics.com; frame-ancestors 'none';"
    # Enforces secure connections via HTTPS, protecting against certain types of man-in-the-middle attacks.
    Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload"
    # Controls information provided as the HTTP Referer header when navigating from your site, enhancing privacy and security.
    Referrer-Policy = "strict-origin-when-cross-origin"
    # Allows you to explicitly enable or disable various browser features and APIs for your site, enhancing security.
    Feature-Policy = "geolocation 'none'; microphone 'none';"

[[redirects]]
  from = "https://developer.cardano.org/*"
  to = "https://developers.cardano.org/:splat"
  status = 301
  force = true