Configure HTTP Headers

[jonaharagon]

X-Frame-Options = "DENY"
X-XSS-Protection = "0"
X-Content-Type-Options = "nosniff"
Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload"
Content-Security-Policy = "default-src 'none'; script-src https://www.privacyguides.org https://api.privacyguides.net 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src data: 'self'; connect-src https://api.github.com https://api.privacyguides.net 'self'"

[netlify]

✅ Deploy Preview for privacyguides ready!

Name	Link
🔨 Latest commit	561f6a7
🔍 Latest deploy log	https://app.netlify.com/sites/privacyguides/deploys/63f8efe6f492870007ccc76e
😎 Deploy Preview	https://deploy-preview-2021--privacyguides.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[jonaharagon]

Jury's out on whether X-XSS-Protection should be set to 0 (disable browser XSS protection) or 1; mode=block (enable and block the entire page load if XSS is detected. Hardenize prefers the former and Mozilla Observatory prefers the latter. Modern consensus (github/secure_headers#439) seems to agree that Mozilla is wrong and Hardenize is correct in this case, so I went with 0. I think this only affects Safari(?) anyways nowadays, so not a big deal outside of losing 10 points on our Mozilla Observatory score.

[privacyguides-bot]

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/v3-0-translations/11920/1