Wed, 13 May 2026 03:30:17 +0000

This was debunked: https://michaelnovati.substack.com/p/a-response-to-lars-lofgrens-codesmith

]]>

Mon, 19 May 2025 07:57:43 +0000

Great article.

]]>

Sat, 19 Apr 2025 12:54:12 +0000

awesome

]]>

Sat, 15 Feb 2025 16:39:52 +0000

Thank you for this excellent resource! A+!

]]>

Tue, 09 Jul 2024 12:24:44 +0000

Hello, great overview. You can also check https://LiteAnalytics.com for your next review.

Lightweight, simple and easy to use, and we also provide free tier for up to 10K monthly page views, good starting point for smaller websites.

]]>

Fri, 28 Jun 2024 06:26:07 +0000

ah… this working… thx you dude

]]>

Fri, 19 Apr 2024 06:47:34 +0000

I have added 3 rules in Cloudflare Transform Rules:
Strict-Transport-Security “max-age=63072000; includeSubDomains; preload”
X-Content-Type-Options “nosniff”
X-Frame-Options “SAMEORIGIN”

and after clearing cache when i hit the domain name from google chrome it shows me error in console
"X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside"

Why is it so?

]]>

Fri, 12 Apr 2024 14:43:26 +0000

Thank you very helpful. I managed to replace all the rules added by a leading security headers plugin using this. They are below for others reference

Header set Access-Control-Allow-Methods "GET,POST"
Header set Access-Control-Allow-Headers "Content-Type, Authorization"
Header set Content-Security-Policy "upgrade-insecure-requests;"
Header set Cross-Origin-Embedder-Policy "unsafe-none; report-to='default'"
Header set Cross-Origin-Embedder-Policy-Report-Only "unsafe-none; report-to='default'"
Header set Cross-Origin-Opener-Policy "unsafe-none"
Header set Cross-Origin-Opener-Policy-Report-Only "unsafe-none; report-to='default'"
Header set Cross-Origin-Resource-Policy "cross-origin"
Header set Permissions-Policy "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header set X-Content-Security-Policy "default-src 'self'; img-src *; media-src * data:;"
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Permitted-Cross-Domain-Policies "none"

]]>

Mon, 01 Apr 2024 15:33:14 +0000

Nice article! Thanks!

]]>

Thu, 28 Mar 2024 13:52:42 +0000

worked great. thank u so much

]]>