# Paste the below in https://play.netlify.com/headers to test
# Set max-age to 1 year for stuff not expected to update any time soon.
/css/*
  Cache-Control: public, max-age=31536000

/js/*
  Cache-Control: public, max-age=31536000

/fonts/*
  Cache-Control: public, max-age=31536000

# Favicons
/favicon.*
  Cache-Control: public, max-age=31536000
/favicon-*.png
  Cache-Control: public, max-age=31536000
/mstile-*.png
  Cache-Control: public, max-age=31536000
/apple-touch-icon.png
  Cache-Control: public, max-age=31536000
/manifest.json
  Cache-Control: public, max-age=31536000

# Also these images used by the refined theme won't be updated frequently.
/images/*
  Cache-Control: public, max-age=31536000

# https://webbkoll.dataskydd.net/en/results?url=https%3A%2F%2Fscripter.co%2F
# Security Headers: https://securityheaders.com/?q=https%3A%2F%2Fscripter.co&followRedirects=on

## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
/*
  Referrer-Policy: same-origin

## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
# I never intend to show any of the pages on my site in a <frame> on my site or
# elsewhere.
/*
  X-Frame-Options: DENY

## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
/*
  X-Xss-Protection: 1; mode=block

## https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
/*
  X-Content-Type-Options: nosniff

# Content Security Policy
## Hashes for Privacy Badger injected scripts: https://gitlab.com/kaushalmodi/kaushalmodi.gitlab.io/blob/29fc983ac72fa886ac39bff6b46dc7e426cb993b/netlify.toml#L174-199
/*
  Content-Security-Policy: default-src 'none'; script-src 'self' 'sha256-O+U/ptNNoUqEhNU1BSkb7izMavM1GxrvRrabNX8WTKE=' 'sha256-YiWMVJIplziLxmHOI6iqs51JQS9W2hg1wDsKBD3u09g=' 'sha256-Zgc2pp+yOmAVogxvTHYBMFKubY0HKk2a0+0+8sX17WY=' 'sha256-kNsowQfHpWMrbQG7AtSzSuMQg2t/YKwmDWdqeKfm4BI=' 'sha256-afSIEhWGAPlY458Q4YkhPLVnsVEBh/u5YNlpg6od8TU=' https://cdn.jsdelivr.net/npm/mathjax@3/ https://d33wubrfki0l68.cloudfront.net/js/ https://cdn.datatables.net 'unsafe-inline'; object-src 'none'; style-src 'self' https://d33wubrfki0l68.cloudfront.net https://cdn.rawgit.com/kaushalmodi/iosevka-mirror/ https://cdn.datatables.net 'unsafe-inline'; img-src 'self' https://d33wubrfki0l68.cloudfront.net https://api.travis-ci.org/kaushalmodi/ https://cdn.datatables.net; font-src https://cdn.jsdelivr.net/npm/mathjax@3/ 'self' about: data: https://cdn.rawgit.com/kaushalmodi/iosevka-mirror/; connect-src 'self'; manifest-src 'self'; media-src 'self'; frame-src https://ghbtns.com https://www.youtube-nocookie.com; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; block-all-mixed-content; report-uri https://c571407e2c6d71ed2021633b7fdad0de.report-uri.com/r/d/csp/enforce;

# Feature Policy
## https://github.com/WICG/feature-policy/blob/master/features.md
## https://scotthelme.co.uk/a-new-security-header-feature-policy/
## https://developers.google.com/web/updates/2018/06/feature-policy
/*
  Feature-Policy: accelerometer 'none' ; ambient-light-sensor 'none' ; autoplay 'self' ; camera 'none' ; encrypted-media 'none' ; fullscreen 'self' ; geolocation 'none' ; gyroscope 'none' ; magnetometer 'none' ; microphone 'none' ; midi 'none' ; payment 'none' ; picture-in-picture * ; speaker 'none' ; sync-xhr 'none' ; usb 'none' ; vr 'none'
