Headers, lovelycode docs

Headers

Set response headers for security, downloads and browser behaviour.

If your site needs custom HTTP headers, add a _headers file at the top level. It uses the path-and-header format from Netlify and Cloudflare Pages. Start with the rules your site needs from these examples:

_headers

# everything on the site
/*
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=()

# fingerprinted assets can be held for a year
/assets/*
  Cache-Control: public, max-age=31536000, immutable

# one segment, by name
/downloads/:file
  Content-Disposition: attachment

# a WebAssembly app that needs threads
/app/*
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Embedder-Policy: require-corp

Each rule is a path on its own line, followed by its headers indented underneath, one Name: value per line. A * at the end of a path covers everything below it; :name stands for one path segment. The indentation matters: a header line that is not indented ends the rule.
When several rules match an address, all of them apply, top to bottom. If two set the same header, the lower one wins.
A rule for /about covers that page however its address is spelled, /about.html and /about/index.html included.

Where they apply

Your headers are added to the files you shipped: pages and assets served with a 200, and the 304 a browser gets when it re-checks one. They are not added to redirects, to 404 responses, to the password form or to the offline page. The editor preview does not apply them either, so check them on the live address.

Cache-Control

The default caching settings make browsers check for updates before reusing files. You can override Cache-Control for files whose names change with their contents, such as app.4f9c2b.css. A max-age lets browsers reuse a file until that time expires. See Caching for an example. HTML keeps no-transform, and password-protected addresses keep private.

Supported headers

Most response headers: Content-Security-Policy, X-Frame-Options, Permissions-Policy, Referrer-Policy, the Cross-Origin-* headers, the Access-Control-* headers, X-Robots-Tag, Link, Content-Disposition, Content-Type, and anything starting with X-.

Headers managed by Lovelycode

Header	Why
Set-Cookie, Clear-Site-Data	They reach across all of lovelyco.de, not just your site
Location, Refresh	Use a _redirects file to set up redirects
Strict-Transport-Security	A promise about the address that would outlive your site on it
ETag, Content-Length, Content-Encoding	They describe the response itself, which we produce

Unsupported headers are skipped without an error; other headers in the rule still apply. Headers set by Lovelycode cannot be removed.

Limits

Limit	Value	If you cross it
File size	64 KB	The whole file is ignored
Paths read	100	The rest are not read
Headers per path	32	The rest are not read
Value length	8 KB	That header is skipped