# Security headers applied site-wide. Wave 1K — see ~/.claude/plans/act-like-a-seo-wobbly-music.md
# These are static-site recommended defaults. CSP is intentionally NOT set here
# because the site emits inline JSON-LD (SEOHead.astro) and inline GTM (when
# PUBLIC_ENABLE_SEO=true); adding `script-src` without a nonce strategy would
# silently break both. CSP rollout is tracked as a separate post-deploy task.
/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  X-XSS-Protection: 1; mode=block
  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()

/_astro/*
  Cache-Control: public, max-age=31536000, immutable

/images/*
  Cache-Control: public, max-age=2592000

/resources/images/*
  Cache-Control: public, max-age=2592000

/resources/_astro/*
  Cache-Control: public, max-age=31536000, immutable

/docs/*.html
  Cache-Control: public, max-age=60, stale-while-revalidate=300

/docs/llms.txt
  Cache-Control: public, max-age=3600

/docs/llms-full.txt
  Cache-Control: public, max-age=3600

/docs/updates.xml
  Cache-Control: public, max-age=600

/developer-docs/*.html
  Cache-Control: public, max-age=60, stale-while-revalidate=300

/developer-docs/llms.txt
  Cache-Control: public, max-age=3600

/developer-docs/llms-full.txt
  Cache-Control: public, max-age=3600

/developer-docs/updates.xml
  Cache-Control: public, max-age=600

/developer-docs/.health.json
  Cache-Control: public, max-age=60

/*.html
  Cache-Control: public, max-age=300

# Wave 1L — tune homepage + content-index caches to crawl-budget-friendly values.
# Was `max-age=0, must-revalidate` which burned crawl budget on every Googlebot
# hit. SWR lets the CDN serve stale immediately while revalidating in the
# background — fast for users, easier on the origin.
/
  Cache-Control: public, max-age=3600, stale-while-revalidate=86400

/resources/blogs/
  Cache-Control: public, max-age=3600, stale-while-revalidate=86400

/resources/ebooks/
  Cache-Control: public, max-age=3600, stale-while-revalidate=86400

# Wave 1 — explicit cache + content-type for new static SEO files.
/robots.txt
  Cache-Control: public, max-age=3600

/llms.txt
  Cache-Control: public, max-age=3600

/.well-known/security.txt
  Cache-Control: public, max-age=86400

/og/*
  Cache-Control: public, max-age=2592000