⚠️ OWASP websites/projects/chapters migration.

[righettod]

Hi,

We (@riramar and myself) created this discussion to share/track with the OSHP community, in a open way, an important coming changes in the OSHP.

The context

📍 The OWASP foundation has decided to move the following elements back to a new CMS:

• OWASP Projects.
• OWASP Chapters.
• OWASP main site.

📡 We have been notified in the middle of january 2026 of the migration by an mail. Actually, we have no more information about access, contribution model, content format, etc.

Our values

🎯 We consider that the core values of an OWASP Project Leader (PL) are the following:

1. Ensure that the project provide useful, accurate and up to date information.
2. Allow everyone to access and contribute to the content.
3. Allow everyone to access to the content or contribute to it, in a free way, from a money perspective.
4. Be the most transparent possible with our community in our action and communication.
5. Assume our mistake and use them to grow.
6. Assume our decision.

Our decision

⚒️ Based on the information we received and our core values, we taken the following decisions:

OSHP content and sub projects will stay on GitHub (GH).

Indeed, it allow:

• Everyone to access to the content anonymously.
• Everyone to contribute with the only condition to have a GH account (free by default).
• To keep the capability to perform a full backup of the project.
• To have modification track record.
• To highlight contributors via the GH built-in feature.
• To use a standard format (markdown) for the content. So, it can used to generate other format in case of need.

A refactoring work will be performed in the coming weeks/months to centralize all the content into the main GH repository.

• One central location: https://github.com/OWASP/www-project-secure-headers
• Allow to leverage GH actions for all automations needs.

Only a landing page will be present on the CMS to allow visitor to reach the OSHP content.

• We do not have any control on the URL of the OSHP project: https://owasp.org/www-project-secure-headers/
• Core content will be on GH.
• If an API exist one day (we asked and it is not the case actually) on the CMS, we will investigate the possibility to generate CMS content from the core content (markdown format) present on GH to propose a rendering alternative on the CMS.
• In all case, master and reference data is on the GH repository.

Next steps

🔬 We are waiting more information from the foundation before to start the migration. Prior to start it, we will freeze the project (no PR accepted and GH workflow will be disabled) for the duration of the migration.

📡 We will update this discussion with information and status.

Disclaimer

ℹ️ All the work done, on the OSHP project and for OWASP in general, by @riramar and me is performed on our spare time only (we are not employee from the OWASP foundation and we do all the work on our own). Therefore, we will do our best to minimize the impact of the migration on our community. However, if an issue occur then feel free to open a bug report issue to inform us and allow us to fix it,

💛 We apologize for this inconvenience, even though we have no connection to the root cause.

Ricardo and Dominique

---

💡 Addendum by Dominique, June 2026:

Storing content on GH in Markdown format allows an AI model to process it. This may be particularly relevant when OSHP content is used to generate configuration documents.

[righettod]

🤔 I asked on the Slack channel for information about the the timeframe regarding the switch of the project's URL from GH pages to the CMS:

🖥️ Until I have reply to allow me to plan the migration work, I let all the GHA workflows enabled to let the project be updated/validated.

[righettod]

📦 I created a tag to keep a copy of the repo prior any migration work:

https://github.com/OWASP/www-project-secure-headers/releases/tag/BeforeMigrationToNewCMS

[righettod]

⚒️ I start migrating content that do no affect the generation of the website via GitHub pages so I disable the GHA in charge generating content:

[righettod]

📝 First set of PR merged to centralize the content:

• [Migration] Centralize content to the main repo #276
• [Migration] Centralize content to the main repo #277
• [Migration] Centralize content to the main repo #278
• [Migration] Centralize content to the main repo #279

📦 Repositories of the sub projects were archived with a notice about the transfer to the main repository:

• https://github.com/oshp/oshp-validator
• https://github.com/oshp/oshp-stats

🏗️ At the stage, we are ready to migrate the core content of the site once the project's domain will be redirected to the CMS by the foundation. No info about the timing for now as well as no control on this.

[righettod]

⚒️ I received the credentials for the new CMS so I can start the migration work.
📅 At this date, I have no information about the date for the URL switch that will be performed by the foundation.

[righettod]

🏗️ This is an overview of the ID card page of the project on the future OWASP website:

[righettod]

📦 The content of the OSHP will be located here once the migration will be finished (folder mainsite):

https://github.com/OWASP/www-project-secure-headers/tree/master/mainsite

[righettod]

📡 New OWASP CMS is currently planned for a release near the March 26th.

[righettod]

💡 Release of the OWASP CMS postponed to a non defined date for the moment.

[righettod]

📡 I asked today on the OWASP Slack channel about the release date of the OWASP CMS:

[righettod]

📡We received a notification that the new website will be released next week:

🧑‍💻 We will now prepare and finalize the transition following our decision regarding the content.

[chinmaypant21]

That's a great news.

[righettod]

🧑‍💻 I have prepared the migrated content on a fork of the repo on my GH personal account:

• https://github.com/righettod/www-project-secure-headers

🕜 I will create the corresponding PR once the project URL will be redirected by the foundation, I have no control or influence on this step.

[righettod]

💡 I just received this notification of cancel:

🧑‍💻 I go ahead with the migration to become independent of the migration schedule on which I have no control or influence:

[righettod]

🧑‍💻 Migrated content merged, I added file and content to not break the deployment on the current github page.

ℹ️ I informed visitors about the situation and update:

[riramar]

Quick question, why not use the link https://github.com/OWASP/www-project-secure-headers instead of https://github.com/OWASP/www-project-secure-headers/tree/master/mainsite ?

[righettod]

You are right I will update it.

[righettod]

ℹ️ We have finalized the migration on our side even if the release of the CMS by the foundation was postponed.

🧑‍💻 Now all the content is centralized and stored in the GitHub repository and use the markdown format.

💡 This way the content:

• Can be consumed by a model.
• Is rendered by GitHub when a browser is used.
• Allow the create of stable remote reference.

[noraj]

So there is no longer a website?

It's like that?

https://owasp.org/www-project-secure-headers/ → (read) → https://github.com/OWASP/www-project-secure-headers → read OSHP ecosystem section of the readme -> main site branch (https://github.com/OWASP/www-project-secure-headers/tree/master/mainsite)

Is that not possible to have GH pages rendering markdown to HTML and serve this over https://owasp.github.io/www-project-secure-headers/? Instead of redirecting to https://owasp.org/www-project-secure-headers/.

Browsing Github directly is ok for tech people, but it's greatly disturbing for other less tech-focus people. Finding the project content has become complicated. Without a website the project lacks visibility. Having to jungle between the redirections and read the whole #273 thread to (eventually) understand there is no longer any website but instead the content must be read with github markdown preview is quite cumbersome.

[righettod]

I understand your disappointment.

The OWASP Foundation has decided, without consultation with project leaders, to move to a custom CMS (which, if I'm not mistaken, will be released tonight) that currently does not allow HTML content to be pushed into it automatically.

The future page to which https://owasp.org/www-project-secure-headers/ redirects will simply be an identity card page on the CMS.

As stated in this thread (created to be transparent about this event), @riramar and I have done our best in our spare time to keep the data consistent and prevent any loss of information during this migration.

This does not mean that there will no longer be an OSHP website like before. However, for the moment, while we wait for the CMS to be fully deployed and obtain more information about how to push content automatically, we have decided to manage the content at the MD level. If the CMS eventually provides a way to push content into it, then we will work on providing a web UI again.

By the way, as also stated in the thread, @riramar and I have no control over where https://owasp.org/www-project-secure-headers/ points to.

In terms of the "jungle," you can trust me when I say that I have been living in it for OSHP since day one of this thread...

So, to summarize, I fully understand that the current situation is not clean, but we are continuing to monitor the evolution and deployment of the CMS in order to find a way to push content to it, provide a web UI for OSHP, and keep the web UI content available at the original URL.

If the situation does not evolve over the coming months, then @riramar and I will investigate the possibility of having a subdomain under the OWASP base domain (pointing to a GitHub page or something else) to provide an HTML rendering of the MD master content.

[noraj]

The OWASP Foundation has decided, without consultation with project leaders, to move to a custom CMS

Yes, the situation is unfortunate.

@riramar and I have done our best in our spare time to keep the data consistent and prevent any loss of information during this migration.

I plainly understand that as a prolific open-source contributor. Thank you for your work.

we have decided to manage the content at the MD level. If the CMS eventually provides a way to push content into it, then we will work on providing a web UI again.
...
If the situation does not evolve over the coming months, then @riramar and I will investigate the possibility of having a subdomain under the OWASP base domain (pointing to a GitHub page or something else) to provide an HTML rendering of the MD master content.

Keeping the MD content on GH, it's possible to use Github Action to store HTML output and Github Action to build the content with a static generator (SSG).

I made a quick and dirty changes of the GitHub Action configuration to server mainsite folder and to render the site content https://noraj.github.io/www-project-secure-headers/mainsite/01_headers.html (without a theme, CSS, etc.).

Other major projects do that like OWASP top ten https://owasp.org/Top10/2025/. Their Github Project use mkdocs SSG (https://github.com/OWASP/Top10/blob/master/mkdocs.yml). They have an old manual workflow where they build mkdocs externally and push the HTML to gh-pages branch instead of doing it automatically with a GH Action. OSHP could more simple use the built-in Jekyll SSG (https://docs.github.com/en/pages/setting-up-a-github-pages-site-with-jekyll) with a proper OWASP theme to server the website under GH Pages.

By the way, as also stated in the thread, @riramar and I have no control over where https://owasp.org/www-project-secure-headers/ points to.

Isn't https://owasp.org/www-project-secure-headers/ = https://github.com/OWASP/www-project-secure-headers/blob/master/index.md? In that case, you only need to modify jekyll config to server mainsite folder (noraj@f1a9e54) and to modify the index page to the mainsite sub-folder noraj@6cd5dc8 or whatever domain you control like https://owasp.github.io/www-project-secure-headers/.

The future page to which https://owasp.org/www-project-secure-headers/ redirects will simply be an identity card page on the CMS.

When that be the case the card will just have to point to your website.

Let me know if I can help in any way.

[righettod]

🔬 I reopened the thread and updated the roadmap to track this web ui point.

[righettod]

This the plan we decided to use to handle this point and to stay consistent with the foundation as well as other OWASP project. As the deployment of the CMS is fully chaotic and is a hell for project leaders:

1. We give a max 6-8 month to the new CMS to propose a decent and stable web API to push content into it in order to keep content on the current known OSHP URL.
2. If provided then we will push a web UI rendering of the MD content into it.
3. Otherwise we will use GH page feature you mentioned combined with a subdomain on the owasp base domain (or a a domain that we will buy ourselves in our subdomain request is rejected) to provide a web UI. The current OSHP URL. will just point to an identity card page on the CMS that will reference the new URL.

I posted this message on the OWASP slack:

[noraj]

Thanks for the update

[righettod]

You are welcome 😉

[righettod]

🐞 The CMS was released but previous URL was not redirected to the new one. This point is 100% out of control of @riramar and me.

• Old: https://owasp.org/www-project-secure-headers
• New: https://owasp.org/projects/secure-headers-project

ℹ️ We are into discussion with the foundation to address the issue and ask them to setup redirection.

[righettod]

Now https://owasp.org/www-project-secure-headers point to https://owasp.github.io/www-project-secure-headers/

🟧 Constraint:

• We need to rename the GH repo as it is asked by the foundation to differentiate project site repo from project code repo. Project site repo will be removed/archived at the beginning of 2027.
• I propose to rename it to the same name as the project on the new owasp site so secure-headers-project.

ℹ️ State and wish for the web ui:

• The content that we want to expose/render is located into the folder mainsite.
• We should use a theme near or same as the one used by by flagship and production owasp project, this, to be consistent with other owasp projects.
• I want to propose a website that contain a real navigation bar to allow an easy and fluid navigation.
• I want that we a visitor land on the site, we inform him about the official new URL of the owasp project and also describe in which site he landed.

🤔 My idea based on what @noraj performed and other project site is the following:

• Use Jekyll built-in feature supported by GH and update the config file.
• Use the theme Dinky.
• Remove the hard coded navigation content from the MD file and replace by expected Jekyll frontmatter
• The file https://github.com/OWASP/www-project-secure-headers/blob/master/index.md will redirect to mainsite web content.

_config.yml:

title: OWASP Secure Headers Project
description: Provides technical information about HTTP security headers.

theme: jekyll-theme-dinky

permalink: /:title/

exclude:
  - README.md
  - CONTRIBUTING.md
  - CODE_OF_CONDUCT.md
  - SECURITY.md
  - CLAUDE.md
  - LICENSE.txt
  - subprojects/
  - archives/
  - .github/
  - .vscode/
  - ci/
  - "*.py"
  - "*.json"
  - "*.yaml"
  - "*.txt"
  - "*.code-workspace"

plugins:
  - jekyll-include-cache

@noraj / @riramar What do you think ?

I will work on a PR on my fork to see how it fit.

[noraj]

It sounds good.

I had a look at https://righettod.github.io/www-project-secure-headers/response-headers/. I think Just the doc is a way better and more appropriate theme than Dinky.

PS: I had to make a redirection block rule to https://righettod.github.io/index/ to be able to see it. It seems the configuration is not fully functional yet. https://righettod.github.io/www-project-secure-headers/ should redirect to https://righettod.github.io/www-project-secure-headers/index/ not https://righettod.github.io/index/.

Maybe the Just the Docs config (https://github.com/righettod/www-project-secure-headers/blob/master/_config.yml) can be enhanced by adding:

• logo
• aux_link (with some OWASP links)
• fine tuning the search
• A color scheme to OWASP colors?

[righettod]

OK i applied the proposed elements in my fork.
I will try to release something this WE...

[righettod]

I released the Web UI for the mainsite and I updated all the documentation.

So https://owasp.org/www-project-secure-headers/ lead to https://owasp.github.io/www-project-secure-headers that land to a website.

I tried renaming the repo but https://owasp.org/www-project-secure-headers/ led to 404 so I need to seed with the foundation how to proceed to renaming.

I asked the question on the slack:

At least a web UI is back for people that prefer to use such version 😉

[righettod]

📡 Communication made on social networks.

[riramar]

Thanks a lot @righettod for doing this! I liked the design of the page.
I have one comment, when selected the font menu and background colors are too close to white. It's kind of difficult to read the text.
I think it'd be good increase the contrast between them.

[righettod]

Hi @riramar

To be 100% honest, as I am really bad at design and UI, I asked Claude code to generate a CSS to have design similar to the theme of the new OWASP site.

I will update the CSS to increase the contrast 😉

[righettod]

@riramar I tried some change for the over and clicked state.

[riramar]

It looks perfect to me now. :)
Thanks!

[righettod]

You are welcome 😉

[righettod]

✅ Project GH repo renamed to match the foundation requirement.
✅ Project page on the OWASP CMS references updated.
✅ Dynamic redirection prepared for the creation of the dedicated sub domain for the project.

[righettod]

✅ Subdomain in place for the web UI: https://secure-headers-project.owasp.org/

[noraj]

Neat 🥳