What problem does it solve? Setting up a Content Security Policy and security headers on an Astro site deployed to Cloudflare Workers Static Assets is confusing: the adapter cannot emit static headers, the CSP meta element silently drops directives like frame-ancestors, and misconfigured COEP or HSTS preload can break the site permanently. This Skill encodes the correct layer split and the gotchas so headers land in the right place the first time. ## Core Features & Use Cases - Layered header architecture: Astro's native security.csp hashes scripts and styles per page (meta element on static pages, response header on SSR), while public/_headers carries HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, and the frame-ancestors directive. - SSR and middleware coverage: Set headers for server-rendered routes in src/middleware.ts, since _headers never touches Worker responses, with an optional nonce path as a last resort. - SRI and verification: Add Subresource Integrity for cross-origin resources via a build-time hash script, then verify deployed headers with curl, scanners, and a CSP evaluator. - Use Case: You are hardening a static marketing site on Cloudflare and need clickjacking protection, a strict CSP without unsafe-inline, and HSTS — without breaking WebGL textures or Rive embeds through an overly aggressive COEP. ## Quick Start Set up a hash-based CSP and the full security header set for my Astro site on Cloudflare Workers, including the _headers file and verification steps.
