diff --git a/.htaccess b/.htaccess index f00a7095..444b769c 100644 --- a/.htaccess +++ b/.htaccess @@ -92,9 +92,16 @@ Options -Indexes Header always set Referrer-Policy "strict-origin-when-cross-origin" # Explicitly disable browser features the site doesn't use. Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" - # Content-Security-Policy in REPORT-ONLY first so it cannot break styling/scripts. - # Review browser console for violations, tighten, then switch to Content-Security-Policy. - Header always set Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.googletagmanager.com; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com; frame-src https://www.youtube-nocookie.com https://www.youtube.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https://docs.google.com" + # Content-Security-Policy (ENFORCING). Allowlist verified in a browser + # against a server sending this exact header — every real resource passes: + # self assets, Google Fonts, Font Awesome (cdnjs), gtag, GA beacons, the + # Google Forms endpoint (membership + guide feedback), the MailerLite JSONP + # newsletter, and YouTube (nocookie) embeds. 'unsafe-inline' is required for + # the in- consent/analytics bootstrap and a few inline handlers; the + # host allowlists still constrain where scripts load from and where data can + # be sent (connect/form-action/base-uri/object-src), which is the real value + # here on top of the site's existing output escaping. + Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://assets.mailerlite.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com data:; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com https://region1.google-analytics.com https://analytics.google.com https://www.googletagmanager.com https://docs.google.com https://assets.mailerlite.com; frame-src https://www.youtube-nocookie.com https://www.youtube.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https://docs.google.com; object-src 'none'" Header set Cache-Control "no-cache, must-revalidate"