Planning the site-public security header rollout

For a while the whole domain sat behind an access login wall — fine for a private preview, useless for a site that is supposed to be read. As I prepared to take that down, I wanted a clear rollout plan for the response headers a public site should carry.

The baseline list is straightforward: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options, Referrer-Policy, and a Permissions-Policy that denies features the site never uses. They are small changes, but I still want to roll them out in a controlled sequence.

The Content-Security-Policy is the valuable one and the easiest to get wrong, so my plan is to start with Content-Security-Policy-Report-Only first. In that mode the browser reports what a strict policy would block but blocks nothing — so I can watch for false positives against fonts or the chat stream before switching to enforcement.