> ## Documentation Index
> Fetch the complete documentation index at: https://cactal.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure response headers

> Add allowlisted security response headers to every published and preview response through website_config.

Cactal sets safe transport and MIME defaults on every website. Add site-specific security policy through the `headers` object in `website_config`.

## Add headers

Use canonical header names in an inline object of string literals.

```tsx website_config theme={null}
import { defineWebsiteConfig } from '@website'

export default defineWebsiteConfig({
	headers: {
		'Content-Security-Policy': "default-src 'self'; script-src 'self' https://cdn.cactal.app 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' https://cdn.cactal.app; object-src 'none'",
		'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
		'Referrer-Policy': 'strict-origin-when-cross-origin',
		'X-Frame-Options': 'SAMEORIGIN'
	}
})
```

The headers apply to published, draft, and version responses after Cactal builds that source version. They also apply to redirects, generated crawler files, favicons, and client-navigation data for the deployment.

## Allowed headers

`headers` accepts these response headers:

* `Content-Security-Policy`
* `Content-Security-Policy-Report-Only`
* `Cross-Origin-Embedder-Policy`
* `Cross-Origin-Opener-Policy`
* `Cross-Origin-Resource-Policy`
* `NEL`
* `Origin-Agent-Cluster`
* `Permissions-Policy`
* `Referrer-Policy`
* `Report-To`
* `Reporting-Endpoints`
* `Strict-Transport-Security`
* `X-Content-Type-Options`
* `X-DNS-Prefetch-Control`
* `X-Frame-Options`
* `X-Permitted-Cross-Domain-Policies`
* `X-XSS-Protection`

Cactal rejects headers that control routing, cookies, content representation, or caching. This includes `Location`, `Set-Cookie`, `Content-Type`, `Content-Length`, `Content-Encoding`, `Cache-Control`, and `Vary`.

## Platform defaults

Website responses include these defaults without configuration:

| Header                      | Platform hostname                     | Custom domain      |
| --------------------------- | ------------------------------------- | ------------------ |
| `X-Content-Type-Options`    | `nosniff`                             | `nosniff`          |
| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains` | `max-age=31536000` |

Custom domains omit `includeSubDomains` because their owners may host unrelated subdomains elsewhere. Set your own allowlisted `Strict-Transport-Security` value when you intentionally want a different policy.

## Validation

The config must remain statically extractable. Use a direct default export, an inline `headers` object, direct property names, and string literal values. Variables, function calls, spreads, computed keys, empty values, and control characters fail `head/check` and publishing.

Test restrictive policies on the draft hostname before publishing. A Content Security Policy, frame policy, or browser capability policy can block resources and integrations your site uses.