Products

Security headers and compression

From the first deploy, every response from your app or function carries a few security headers and text responses are compressed, with no setup, on every plan. This page shows what each one does and how to change it.

What you get by default#

Header	Value
`Strict-Transport-Security`	`max-age=31536000` (one year)
`X-Content-Type-Options`	`nosniff`
`Referrer-Policy`	`strict-origin-when-cross-origin`
`X-Frame-Options`	`SAMEORIGIN`

A header your app sets itself, or a _headers rule sets or removes, always wins; we never overwrite one. No Content-Security-Policy is added until you set one, because a default policy would break many apps. Headers that reveal what software a site runs on are always removed.

Text, JSON, JavaScript, CSS, SVG, XML and WebAssembly responses over 1 KiB are compressed to what the browser accepts: Brotli, otherwise gzip. A response that is already compressed, a byte range, or one with Cache-Control: no-transform is left alone. Smaller responses also mean less outgoing traffic on your bill.

The settings#

Setting	What it does and its default
`security_headers` · `--headers on\|off`	On (the default) or off: adds the headers above to responses that lack them. Off adds none of them (headers that reveal the software are still removed).
`hsts_subdomains` · `--hsts-subdomains on\|off`	Off (the default). On adds `includeSubDomains` to `Strict-Transport-Security`, so subdomains are also opened over HTTPS only.
`frame` · `--frame sameorigin\|deny\|off`	Who may show the site in a frame. `sameorigin` (the default): only the site itself; `deny`: nobody; `off`: no `X-Frame-Options` is added.
`csp` · `--csp "<policy>"\|none`	A `Content-Security-Policy` on one line, up to 4096 characters, added to responses that have none. Default: none. `null` in the API, or `none` in the CLI, removes it.
`compression` · `--compression auto\|off`	`auto` (the default) compresses as described above; `off` sends responses as they are.

Each setting belongs to one app or function. Any role can read it; changing it needs the owner, admin or developer role. Every change is recorded in the activity log.

Changing them#

cloudhost delivery show --project shop --app my-site
cloudhost delivery set --project shop --app my-site --frame deny --csp "default-src 'self'; img-src https:"
cloudhost delivery set --project shop --app my-site --hsts-subdomains on --compression off
cloudhost delivery set --project shop --app my-site --csp none

delivery show prints the current setting and the headers that are added; delivery set changes only the flags you give. --app is the app or function name (or <project>/<name>); without it, the one in the project file. For a function the API path is …/functions/<name>/delivery.

cloudhost deploy applies the project file's [delivery] section to production; a preview deploy leaves the settings as they are. A value that is not allowed gets a 400 with delivery_bad_body, delivery_bad_frame, delivery_bad_compression or delivery_bad_csp.