Site security headers
Set HTTP security headers at the CloudFront edge for static sites: the safe preset, frame options, permissions policy and Content-Security-Policy.
HTTP security headers set at the CloudFront edge for static sites (what securityheaders.com grades). Opt-in via securityHeaders; applied on openkbs site deploy, propagation a few minutes. Omitted key = untouched.
{ "site": "./site", "securityHeaders": true }Values
| Value | Effect |
|---|---|
true | Preset: Strict-Transport-Security (1 year), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin. Safe for every site; no quota cost. |
{ ... } | Preset plus the keys below (per-project policy; 20 per account). |
false | Remove the policy on next deploy. |
Policy keys
| Key | Effect |
|---|---|
frameOptions | "SAMEORIGIN" or "DENY" — blocks clickjacking. Alone it also blocks the studio live-preview iframe. Keep the preview by adding frame-ancestors 'self' https://<studio-host> to csp (browsers that support frame-ancestors ignore X-Frame-Options); the studio host is the domain you are working in (e.g. https://openkbs.com). https://*.example.com does NOT cover the bare example.com — list both. |
permissionsPolicy | e.g. "camera=(), microphone=(), geolocation=()". Never disable a feature the site uses (voice agents need microphone). |
csp | Content-Security-Policy. Must list every origin the site loads (scripts, styles, fonts, images, connect-src for APIs, frame-src for embeds); generated sites usually need 'unsafe-inline' for script/style. A wrong CSP breaks the site with no server error — test with cspReportOnly first, then check the browser console. |
cspReportOnly | Same syntax, reports violations in the console instead of blocking. |
Grades and limits
Grade A on securityheaders.com needs all of frameOptions, permissionsPolicy and csp; the preset alone lifts a site from F to roughly C. A+ is out of reach while any inline script exists (GTM bootstrap, cookie banners) — static CDN sites cannot use nonces, so 'unsafe-inline' in script-src is normal and expected; it is not a reason to remove those tags.
If site deploy prints Warning: edge config ... not applied it exits 2: the files are live but the headers/redirects are not — do not treat the deploy as complete until the edge config has applied.