Personal Portfolio with Security Hardening
LiveThe site you are reading right now. Built with Astro and Tailwind, deployed on Cloudflare Pages with continuous deployment from GitHub, in English and Spanish.
When I first deployed it, securityheaders.com graded it D: only Referrer-Policy and X-Content-Type-Options were present, both set automatically by Cloudflare. I added the missing headers with a _headers file that Cloudflare Pages reads on every deploy — no dashboards, no clicks — and the site now scores A.
What each header defends against
- Strict-Transport-Security: HTTPS only, for a year, subdomains included — blocks downgrade attacks on the first plain-HTTP request.
- X-Frame-Options: DENY — nobody can load the site in an iframe, which shuts down clickjacking.
- X-Content-Type-Options: nosniff — the browser trusts the declared content type instead of guessing.
- Permissions-Policy — camera, microphone, geolocation, payment and USB switched off.
- Content-Security-Policy — scripts, styles and connections limited to the site itself and a short allow-list.