-
Notifications
You must be signed in to change notification settings - Fork 1
/
starterHtml.html
62 lines (46 loc) · 2.2 KB
/
starterHtml.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
<!DOCTYPE html>
<!-- Or whatever language you use -->
<html lang="en-US">
<head>
<!-- If you're using a framework, some of these might go in your code instead. -->
<!-- Used for security. If this tag is used, it goes first.
See https://infosec.mozilla.org/guidelines/web_security#content-security-policy for more details.
Also note " upgrade-insecure-requests; " which changes your links from HTTP to HTTPS (without checking if that actually works).
Below is a reasonably strict guideline, which can be relaxed during testing.
For example, frameworks sometimes add inline script tags, which can be allowed with "script-src 'self' unsafe-inline;".
Note that CSPs can only further restrict the policy. So if the server also sends a good CSP, that CSP won't be weakened.
Incidentally if you control the server headers then this tag isn't needed. -->
<meta http-equiv="content-security-policy"
content="default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'">
<!-- These two meta tags also go first. -->
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<!-- Change all of these. You can delete keywords if you want -->
<title></title>
<meta name="description" content="">
<meta name="keywords" content="">
<meta name="author" content="icecream17"> <!-- If you're not me, you might want to change this -->
<!-- Don't send page information to links; prevents tracking -->
<meta name="referrer" content="no-referrer">
<!-- Less important
<meta name="theme-color" content="#fff">
<meta name="color-scheme" content="normal">
<link rel="icon" href="">
<link rel="apple-touch-icon" href="">
<link rel="manifest" href="">
-->
<!-- Choose one (or use a framework)
CSS and JS: big project
<link rel="stylesheet" href="css/style.css">
<script defer src="js/main.js"></script>
CSS and JS: small project
<link rel="stylesheet" href="style.css">
<script defer src="main.js"></script>
-->
</head>
<body>
<noscript>
<!-- Insert message to users not using JS -->
</noscript>
</body>
</html>