Skip to main content
Cactal sets safe transport and MIME defaults on every website. Add site-specific security policy through the headers object in website_config.

​
Add headers

Use canonical header names in an inline object of string literals.
website_config
The headers apply to published, draft, and version responses after Cactal builds that source version. They also apply to redirects, generated crawler files, favicons, and client-navigation data for the deployment.

​
Allowed headers

headers accepts these response headers:
  • Content-Security-Policy
  • Content-Security-Policy-Report-Only
  • Cross-Origin-Embedder-Policy
  • Cross-Origin-Opener-Policy
  • Cross-Origin-Resource-Policy
  • NEL
  • Origin-Agent-Cluster
  • Permissions-Policy
  • Referrer-Policy
  • Report-To
  • Reporting-Endpoints
  • Strict-Transport-Security
  • X-Content-Type-Options
  • X-DNS-Prefetch-Control
  • X-Frame-Options
  • X-Permitted-Cross-Domain-Policies
  • X-XSS-Protection
Cactal rejects headers that control routing, cookies, content representation, or caching. This includes Location, Set-Cookie, Content-Type, Content-Length, Content-Encoding, Cache-Control, and Vary.

​
Platform defaults

Website responses include these defaults without configuration: Custom domains omit includeSubDomains because their owners may host unrelated subdomains elsewhere. Set your own allowlisted Strict-Transport-Security value when you intentionally want a different policy.

​
Validation

The config must remain statically extractable. Use a direct default export, an inline headers object, direct property names, and string literal values. Variables, function calls, spreads, computed keys, empty values, and control characters fail head/check and publishing. Test restrictive policies on the draft hostname before publishing. A Content Security Policy, frame policy, or browser capability policy can block resources and integrations your site uses.