v1.1.2

Website security hardening

The website now sends a full set of security headers, aiming for an A+ on securityheaders.com and the Mozilla Observatory.

What's new

• Strict Content Security Policy. The page loads scripts, styles and images only from its own origin. It allows no inline code, cannot be framed, and blocks form submissions and <base> overrides.
• HSTS with a 2-year max-age, so browsers always use HTTPS.
• Extra hardening headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, a restrictive Permissions-Policy, and same-origin Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy.
• Server tidy-up: UTF-8 charset on the HTML, CSS and JS, directory listing disabled, and the server signature hidden.

Changes under the hood

• The inline CSS and JavaScript have moved to Website/style.css and Website/app.js.
• Inline onclick and style attributes are gone. Event listeners and swatch colours are now set up in app.js.
• The page should look and behave exactly as before.

Upgrading / self-hosting

• Deploy all of Website/: index.html, style.css, app.js and .htaccess.
• Apache needs mod_headers enabled. Without it, the headers are skipped without any error.
• If you're behind Cloudflare, purge the cache after deploying.
• HSTS applies to the main hostname only. Add includeSubDomains; preload only if every web-facing subdomain already works over HTTPS.