_headers

# Canonical origin https://cipi.sh — reinforce HTTPS at the browser
/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  X-Robots-Tag: index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1
  Content-Language: en

# Error pages must never enter the index
/404.html
  X-Robots-Tag: noindex, nofollow

# Serve .sh files as plain text for piping to bash
/setup.sh
  Content-Type: text/plain; charset=utf-8

# Sitemap: text/xml triggers native browser XML/XSL view more reliably than application/xml
/sitemap.xml
  Content-Type: text/xml; charset=utf-8
  X-Content-Type-Options: nosniff

/sitemap.xsl
  Content-Type: text/xsl; charset=utf-8

# LLM-friendly plain-text summaries
/llms.txt
  Content-Type: text/plain; charset=utf-8
/llms-full.txt
  Content-Type: text/plain; charset=utf-8

# RFC 9116 security contact file
/.well-known/security.txt
  Content-Type: text/plain; charset=utf-8

# Long-lived static assets — hashed-by-name is not used, but these change rarely
/css/*
  Cache-Control: public, max-age=604800, stale-while-revalidate=86400
/*.png
  Cache-Control: public, max-age=604800, stale-while-revalidate=86400
/*.svg
  Cache-Control: public, max-age=604800, stale-while-revalidate=86400
/img/*
  Cache-Control: public, max-age=604800, stale-while-revalidate=86400
/*.js
  Cache-Control: public, max-age=86400, stale-while-revalidate=86400