More restrictive content security policy for Web site

This commit is contained in:
Ben Harris 2025-10-12 13:53:45 +01:00
parent da628c5e44
commit 4c3abb66be

View File

@ -6,4 +6,7 @@ AddType font/otf;outlines=CFF .otf
</FilesMatch>
AddOutputFilterByType DEFLATE application/xhtml+xml text/css font/otf \
text/plain text/x-csrc application/postscript
Header set Content-Security-Policy "object-src 'none';"
Header set Content-Security-Policy "form-action 'none';\
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self';\
script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval';\
style-src 'self' 'unsafe-inline'"