The site is served from GitHub Pages (which cannot set HTTP response headers) proxied
through Cloudflare. The static/_headers file in this repo is the authoritative source
of truth for all security headers. It will be enforced automatically if the site ever
migrates to Cloudflare Pages.
Until then, configure the following directly in Cloudflare.
Location: Cloudflare Dashboard → sovren.software → Rules → Transform Rules → Modify Response Header → Create Rule
Rule name: Security Headers
When incoming requests match: (hostname eq "sovren.software" or hostname eq "www.sovren.software")
Then: Add the following Set operations (static values):
| Header | Value |
|---|---|
X-Frame-Options |
DENY |
X-Content-Type-Options |
nosniff |
Referrer-Policy |
strict-origin-when-cross-origin |
Permissions-Policy |
camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=() |
Cross-Origin-Opener-Policy |
same-origin |
Cross-Origin-Resource-Policy |
same-origin |
Content-Security-Policy |
default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' mailto: |
Note: Do not configure Strict-Transport-Security (HSTS) here — Cloudflare manages
HSTS automatically when "Always Use HTTPS" is enabled. Enable it under:
SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS) → Enable with
max-age=63072000, includeSubDomains, and preload checked.
After saving the rule, verify headers are present:
curl -sI https://sovren.software | grep -E "x-frame|x-content|referrer|permissions|csp|cross-origin"Expected output should include all headers listed above.
Migrating to Cloudflare Pages (instead of GitHub Pages) will enforce these headers
automatically via static/_headers without any dashboard configuration. Steps:
- Create a Cloudflare Pages project pointing to this repo
- Set build command:
npm run build, output dir:dist - Add custom domain
sovren.softwarein Cloudflare Pages settings - Update DNS: replace the 4 GitHub Pages A records with Cloudflare Pages CNAME
- Remove
static/CNAME(Cloudflare Pages does not use it) - Update
deploy.ymlto usecloudflare/wrangler-action@v3withCLOUDFLARE_API_TOKENandCLOUDFLARE_ACCOUNT_IDrepository secrets - Disable GitHub Pages in repository settings