[{"data":1,"prerenderedAt":1643},["ShallowReactive",2],{"page:\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fenabling-hsts-and-preload-safely":3,"all-docs-nav":1101},{"id":4,"title":5,"body":6,"breadcrumb":1076,"dateModified":1086,"datePublished":1086,"description":1087,"extension":1088,"faq":1089,"meta":1094,"navigation":1095,"path":1096,"seo":1097,"slug":12,"stem":1098,"type":1099,"__hash__":1100},"content\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fenabling-hsts-and-preload-safely\u002Findex.md","Enabling HSTS and Preload Safely",{"type":7,"value":8,"toc":1058},"minimark",[9,13,22,31,36,57,61,67,240,243,370,373,377,383,502,509,517,599,603,606,639,645,649,652,759,766,770,776,779,783,853,922,926,965,969,979,983,988,991,995,998,1002,1005,1009,1012,1016,1054],[10,11,5],"h1",{"id":12},"enabling-hsts-and-preload-safely",[14,15,16,17,21],"p",{},"Every mainstream static host redirects HTTP to HTTPS, and every HTTPS page carries a valid certificate. That feels finished, but a redirect still means the reader's browser sent one request in plain text first, and anyone positioned on the network — a hostile Wi-Fi hotspot, a compromised router — can answer that request instead of your server. ",[18,19,20],"code",{},"Strict-Transport-Security"," tells the browser never to make that plain-text request again. The HSTS preload list goes one step further and builds your domain into the browser itself, so even a reader's very first visit is HTTPS-only.",[14,23,24,25,30],{},"Both are one header. Both are also sticky in a way almost no other web setting is: browsers remember HSTS for as long as you told them to, and preload list entries ship inside browser releases. A mistake — an internal tool on a subdomain that only works over HTTP — can make that subdomain unreachable for months. This guide rolls HSTS out in stages that make mistakes cheap. It is part of ",[26,27,29],"a",{"href":28},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002F","Security Headers and Hardening for Static Sites",".",[32,33,35],"h2",{"id":34},"prerequisites","Prerequisites",[37,38,39,43,46],"ul",{},[40,41,42],"li",{},"HTTPS working on the apex domain and every subdomain you intend to keep.",[40,44,45],{},"Access to DNS for the domain, to list every subdomain.",[40,47,48,49,52,53,56],{},"A way to set response headers at the host — ",[18,50,51],{},"_headers",", ",[18,54,55],{},"vercel.json",", a CloudFront response headers policy, or server config.",[32,58,60],{"id":59},"step-1-inventory-every-subdomain","Step 1: Inventory Every Subdomain",[14,62,63,66],{},[18,64,65],{},"includeSubDomains"," applies the policy to every name under the domain, including ones you forgot. Before touching the header, list them from DNS and from certificate transparency logs, which record every certificate ever issued for the domain:",[68,69,74],"pre",{"className":70,"code":71,"language":72,"meta":73,"style":73},"language-bash shiki shiki-themes github-light github-dark","# from DNS (zone export or provider API), then from CT logs:\ncurl -s \"https:\u002F\u002Fcrt.sh\u002F?q=%25.example.com&output=json\" \\\n  | jq -r '.[].name_value' | tr '\\n' '\\n' | sort -u > ct-names.txt\nwhile read -r host; do\n  code=$(curl -s -o \u002Fdev\u002Fnull -w '%{http_code}' --max-time 5 \"https:\u002F\u002F$host\u002F\")\n  echo \"$code $host\"\ndone \u003C ct-names.txt\n","bash","",[18,75,76,85,103,144,165,211,229],{"__ignoreMap":73},[77,78,81],"span",{"class":79,"line":80},"line",1,[77,82,84],{"class":83},"sJ8bj","# from DNS (zone export or provider API), then from CT logs:\n",[77,86,88,92,96,100],{"class":79,"line":87},2,[77,89,91],{"class":90},"sScJk","curl",[77,93,95],{"class":94},"sj4cs"," -s",[77,97,99],{"class":98},"sZZnC"," \"https:\u002F\u002Fcrt.sh\u002F?q=%25.example.com&output=json\"",[77,101,102],{"class":94}," \\\n",[77,104,106,110,113,116,119,122,125,128,130,132,135,138,141],{"class":79,"line":105},3,[77,107,109],{"class":108},"szBVR","  |",[77,111,112],{"class":90}," jq",[77,114,115],{"class":94}," -r",[77,117,118],{"class":98}," '.[].name_value'",[77,120,121],{"class":108}," |",[77,123,124],{"class":90}," tr",[77,126,127],{"class":98}," '\\n'",[77,129,127],{"class":98},[77,131,121],{"class":108},[77,133,134],{"class":90}," sort",[77,136,137],{"class":94}," -u",[77,139,140],{"class":108}," >",[77,142,143],{"class":98}," ct-names.txt\n",[77,145,147,150,153,155,158,162],{"class":79,"line":146},4,[77,148,149],{"class":108},"while",[77,151,152],{"class":94}," read",[77,154,115],{"class":94},[77,156,157],{"class":98}," host",[77,159,161],{"class":160},"sVt8B","; ",[77,163,164],{"class":108},"do\n",[77,166,168,171,174,177,179,181,184,187,190,193,196,199,202,205,208],{"class":79,"line":167},5,[77,169,170],{"class":160},"  code",[77,172,173],{"class":108},"=",[77,175,176],{"class":160},"$(",[77,178,91],{"class":90},[77,180,95],{"class":94},[77,182,183],{"class":94}," -o",[77,185,186],{"class":98}," \u002Fdev\u002Fnull",[77,188,189],{"class":94}," -w",[77,191,192],{"class":98}," '%{http_code}'",[77,194,195],{"class":94}," --max-time",[77,197,198],{"class":94}," 5",[77,200,201],{"class":98}," \"https:\u002F\u002F",[77,203,204],{"class":160},"$host",[77,206,207],{"class":98},"\u002F\"",[77,209,210],{"class":160},")\n",[77,212,214,217,220,223,226],{"class":79,"line":213},6,[77,215,216],{"class":94},"  echo",[77,218,219],{"class":98}," \"",[77,221,222],{"class":160},"$code",[77,224,225],{"class":160}," $host",[77,227,228],{"class":98},"\"\n",[77,230,232,235,238],{"class":79,"line":231},7,[77,233,234],{"class":108},"done",[77,236,237],{"class":108}," \u003C",[77,239,143],{"class":160},[14,241,242],{},"On the site used here, DNS listed 9 subdomains; certificate transparency revealed 14, including a 2019 conference microsite, a status page on a third-party service and an internal metrics dashboard. Two of them failed on HTTPS: the old microsite (certificate expired) and a printer-management page on an office subdomain that only spoke HTTP.",[244,245,246,366],"figure",{},[247,248,255,256,255,260,255,264,255,271],"svg",{"viewBox":249,"role":250,"ariaLabelledBy":251,"xmlns":254},"0 0 760 290","img",[252,253],"hsts-sub-title","hsts-sub-desc","http:\u002F\u002Fwww.w3.org\u002F2000\u002Fsvg","\n  ",[257,258,259],"title",{"id":252},"Subdomain audit before includeSubDomains",[261,262,263],"desc",{"id":253},"Fourteen subdomains found through DNS and certificate transparency. Twelve serve valid HTTPS and are safe. One old microsite has an expired certificate and must be renewed or removed. One office printer page only speaks HTTP and must be moved to a different domain before includeSubDomains is enabled.",[265,266],"rect",{"x":267,"y":267,"width":268,"height":269,"fill":270},"0","760","290","#ffffff",[272,273,275,276,275,284,275,295,275,301,275,306,275,310,275,314,275,320,275,328,275,332,275,338,275,344,275,350,275,354,275,357,275,362,255],"g",{"style":274},"font-family:system-ui, sans-serif;font-size:12px","\n    ",[277,278,283],"text",{"x":279,"y":280,"fill":281,"style":282},"380","28","#1f2937","font-size:16px;font-weight:700;text-anchor:middle","14 names under example.com, 2 blockers",[265,285],{"x":286,"y":287,"width":288,"height":289,"rx":290,"fill":291,"opacity":292,"stroke":293,"style":294},"40","56","440","190","12","#8ac926","0.1","#5a8a16","stroke-width:1.5px",[277,296,300],{"x":297,"y":298,"fill":281,"style":299},"260","82","font-weight:700;text-anchor:middle","12 serve valid HTTPS",[277,302,305],{"x":303,"y":304,"fill":281},"60","112","www · docs · blog · api · assets · img",[277,307,309],{"x":303,"y":308,"fill":281},"138","status (vendor) · auth · mail · shop",[277,311,313],{"x":303,"y":312,"fill":281},"164","preview · staging",[277,315,319],{"x":303,"y":316,"fill":317,"style":318},"208","#3f6410","font-weight:700","safe for includeSubDomains",[265,321],{"x":322,"y":287,"width":323,"height":324,"rx":290,"fill":325,"opacity":326,"stroke":327,"style":294},"500","220","86","#ffca3a","0.2","#a97b00",[277,329,331],{"x":330,"y":298,"fill":281,"style":299},"610","conf2019",[277,333,337],{"x":330,"y":334,"fill":335,"style":336},"104","#556071","font-size:11px;text-anchor:middle","expired certificate",[277,339,343],{"x":330,"y":340,"fill":341,"style":342},"126","#8a6d0f","font-size:11px;font-weight:700;text-anchor:middle","archive or delete DNS",[265,345],{"x":322,"y":346,"width":323,"height":324,"rx":290,"fill":347,"opacity":348,"stroke":349,"style":294},"160","#ff595e","0.14","#d83b41",[277,351,353],{"x":330,"y":352,"fill":281,"style":299},"186","printers.office",[277,355,356],{"x":330,"y":316,"fill":335,"style":336},"HTTP only, no TLS",[277,358,361],{"x":330,"y":359,"fill":360,"style":342},"230","#b32b30","move to another domain",[277,363,365],{"x":279,"y":364,"fill":335,"style":336},"276","DNS listed 9 names; certificate transparency logs revealed the other 5",[367,368,369],"figcaption",{},"The subdomains nobody remembers are exactly the ones certificate transparency logs find, and exactly the ones includeSubDomains would break.",[14,371,372],{},"The printer page moved to a separate internal domain; the microsite's DNS record was deleted after its content was archived into the main site. Only then was the domain ready.",[32,374,376],{"id":375},"step-2-ramp-max-age-in-stages","Step 2: Ramp max-age in Stages",[14,378,379,380,382],{},"Start with a short lifetime and no subdomains, increase over weeks, and add ",[18,381,65],{}," only once the inventory is clean:",[384,385,386,405],"table",{},[387,388,389],"thead",{},[390,391,392,396,399,402],"tr",{},[393,394,395],"th",{},"Stage",[393,397,398],{},"Header",[393,400,401],{},"Hold for",[393,403,404],{},"Worst-case lockout",[406,407,408,425,440,455,470,486],"tbody",{},[390,409,410,414,419,422],{},[411,412,413],"td",{},"1",[411,415,416],{},[18,417,418],{},"max-age=300",[411,420,421],{},"1 day",[411,423,424],{},"5 minutes",[390,426,427,430,435,438],{},[411,428,429],{},"2",[411,431,432],{},[18,433,434],{},"max-age=86400",[411,436,437],{},"1 week",[411,439,421],{},[390,441,442,445,450,453],{},[411,443,444],{},"3",[411,446,447],{},[18,448,449],{},"max-age=604800; includeSubDomains",[411,451,452],{},"2 weeks",[411,454,437],{},[390,456,457,460,465,468],{},[411,458,459],{},"4",[411,461,462],{},[18,463,464],{},"max-age=2592000; includeSubDomains",[411,466,467],{},"1 month",[411,469,467],{},[390,471,472,475,480,483],{},[411,473,474],{},"5",[411,476,477],{},[18,478,479],{},"max-age=31536000; includeSubDomains",[411,481,482],{},"ongoing",[411,484,485],{},"1 year",[390,487,488,491,496,499],{},[411,489,490],{},"6 (optional)",[411,492,493],{},[18,494,495],{},"max-age=63072000; includeSubDomains; preload",[411,497,498],{},"permanent",[411,500,501],{},"months after removal",[68,503,507],{"className":504,"code":506,"language":277,"meta":73},[505],"language-text","# _headers — stage 3\n\u002F*\n  Strict-Transport-Security: max-age=604800; includeSubDomains\n",[18,508,506],{"__ignoreMap":73},[14,510,511,512,516],{},"At each stage, watch for reports of unreachable pages — support tickets, 4xx spikes in edge logs for subdomains, and synthetic checks against every subdomain from the inventory, like those described in ",[26,513,515],{"href":514},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fuptime-and-synthetic-checks-for-static-sites\u002F","Uptime and Synthetic Checks for Static Sites",". The ramp exists so a mistake found at stage 3 costs at most a week.",[244,518,519,596],{},[247,520,255,525,255,528,255,531,255,533],{"viewBox":521,"role":250,"ariaLabelledBy":522,"xmlns":254},"0 0 760 260",[523,524],"hsts-ramp-title","hsts-ramp-desc",[257,526,527],{"id":523},"max-age ramp over seven weeks",[261,529,530],{"id":524},"A step chart of the HSTS max-age on a log scale over about seven weeks: 5 minutes for a day, 1 day for a week, 1 week with includeSubDomains for two weeks, 30 days for a month, then 1 year. Each step is taken only after the previous one ran without incidents.",[265,532],{"x":267,"y":267,"width":268,"height":297,"fill":270},[272,534,275,535,275,538,275,543,275,546,275,552,275,554,275,556,275,560,275,563,275,570,275,575,275,580,275,584,275,588,275,592,255],{"style":274},[277,536,537],{"x":279,"y":280,"fill":281,"style":282},"Raise the commitment only as confidence grows",[79,539],{"x1":540,"y1":541,"x2":542,"y2":541,"stroke":335,"style":294},"80","210","720",[79,544],{"x1":540,"y1":545,"x2":540,"y2":541,"stroke":335,"style":294},"50",[277,547,551],{"x":548,"y":549,"fill":335,"style":550},"72","206","font-size:11px;text-anchor:end","5 min",[277,553,421],{"x":548,"y":346,"fill":335,"style":550},[277,555,437],{"x":548,"y":340,"fill":335,"style":550},[277,557,559],{"x":548,"y":558,"fill":335,"style":550},"98","30 days",[277,561,485],{"x":548,"y":562,"fill":335,"style":550},"62",[564,565],"polyline",{"points":566,"fill":567,"stroke":568,"style":569},"80,202 100,202 100,156 200,156 200,122 400,122 400,94 640,94 640,58 720,58","none","#6a4c93","stroke-width:2.5px",[277,571,574],{"x":572,"y":573,"fill":281,"style":336},"300","114","+ includeSubDomains",[277,576,579],{"x":577,"y":578,"fill":335,"style":336},"100","228","day 1",[277,581,583],{"x":582,"y":578,"fill":335,"style":336},"200","wk 1",[277,585,587],{"x":586,"y":578,"fill":335,"style":336},"400","wk 3",[277,589,591],{"x":590,"y":578,"fill":335,"style":336},"640","wk 7",[277,593,595],{"x":586,"y":594,"fill":335,"style":336},"252","log-scale y axis; each step held until checks and support queues stayed quiet",[367,597,598],{},"Seven weeks from nothing to a year-long policy, with the worst-case cost of a mistake never exceeding the stage you were in.",[32,600,602],{"id":601},"step-3-decide-on-preload","Step 3: Decide on Preload",[14,604,605],{},"With a year-long policy covering subdomains, the domain qualifies for the HSTS preload list at hstspreload.org. Preloading removes the last gap — a reader's first-ever visit — and it is what large, security-sensitive sites do. It also has costs that do not apply to the header alone:",[37,607,608,619,625],{},[40,609,610,614,615,618],{},[611,612,613],"strong",{},"Every subdomain, forever."," Any future subdomain must serve HTTPS from its first day. A marketing agency spinning up ",[18,616,617],{},"campaign.example.com"," on a plain-HTTP host will not work.",[40,620,621,624],{},[611,622,623],{},"Slow removal."," Removal requests are processed, then shipped in browser releases; users on old browser versions keep the entry longer. Plan on months.",[40,626,627,630,631,634,635,638],{},[611,628,629],{},"The whole registrable domain."," You cannot preload ",[18,632,633],{},"docs.example.com"," alone; the entry is for ",[18,636,637],{},"example.com"," and everything beneath it.",[14,640,641,642,644],{},"For a documentation or marketing site on a domain the organisation fully controls, with DNS changes going through review, preload is a reasonable final step. For a domain shared with many teams or agencies, the header with ",[18,643,65],{}," gives nearly all the benefit without the permanence.",[32,646,648],{"id":647},"step-4-verify","Step 4: Verify",[14,650,651],{},"After each stage, confirm the header is present on every response type — HTML, assets, redirects and error pages — because some hosts apply header rules only to successful responses:",[68,653,655],{"className":70,"code":654,"language":72,"meta":73,"style":73},"for p in \u002F \u002Fguides\u002F \u002Fdoes-not-exist\u002F \u002F_astro\u002Fapp.js; do\n  printf '%-22s ' \"$p\"; curl -sI \"https:\u002F\u002Fexample.com$p\" | grep -i '^strict-transport' || echo MISSING\ndone\ncurl -sI http:\u002F\u002Fexample.com\u002F | head -3     # must be a 301 to https, no HSTS on the HTTP response\n",[18,656,657,684,734,739],{"__ignoreMap":73},[77,658,659,662,665,668,671,674,677,680,682],{"class":79,"line":80},[77,660,661],{"class":108},"for",[77,663,664],{"class":160}," p ",[77,666,667],{"class":108},"in",[77,669,670],{"class":98}," \u002F",[77,672,673],{"class":98}," \u002Fguides\u002F",[77,675,676],{"class":98}," \u002Fdoes-not-exist\u002F",[77,678,679],{"class":98}," \u002F_astro\u002Fapp.js",[77,681,161],{"class":160},[77,683,164],{"class":108},[77,685,686,689,692,694,697,700,702,704,707,710,712,714,716,719,722,725,728,731],{"class":79,"line":87},[77,687,688],{"class":94},"  printf",[77,690,691],{"class":98}," '%-22s '",[77,693,219],{"class":98},[77,695,696],{"class":160},"$p",[77,698,699],{"class":98},"\"",[77,701,161],{"class":160},[77,703,91],{"class":90},[77,705,706],{"class":94}," -sI",[77,708,709],{"class":98}," \"https:\u002F\u002Fexample.com",[77,711,696],{"class":160},[77,713,699],{"class":98},[77,715,121],{"class":108},[77,717,718],{"class":90}," grep",[77,720,721],{"class":94}," -i",[77,723,724],{"class":98}," '^strict-transport'",[77,726,727],{"class":108}," ||",[77,729,730],{"class":94}," echo",[77,732,733],{"class":98}," MISSING\n",[77,735,736],{"class":79,"line":105},[77,737,738],{"class":108},"done\n",[77,740,741,743,745,748,750,753,756],{"class":79,"line":146},[77,742,91],{"class":90},[77,744,706],{"class":94},[77,746,747],{"class":98}," http:\u002F\u002Fexample.com\u002F",[77,749,121],{"class":108},[77,751,752],{"class":90}," head",[77,754,755],{"class":94}," -3",[77,757,758],{"class":83},"     # must be a 301 to https, no HSTS on the HTTP response\n",[14,760,761,762,765],{},"Browsers ignore HSTS on plain-HTTP responses by design, so its absence there is correct. Chrome's ",[18,763,764],{},"chrome:\u002F\u002Fnet-internals\u002F#hsts"," page shows whether the browser has stored the policy for the domain and with what expiry, which is useful when testing the ramp.",[32,767,769],{"id":768},"keeping-new-subdomains-compliant","Keeping New Subdomains Compliant",[14,771,772,773,775],{},"Once ",[18,774,65],{}," is live, the risk moves from the past to the future: the next subdomain someone creates. Three guard rails keep it from becoming an outage. First, route DNS changes through a pull request against a DNS-as-code repository (Terraform, OctoDNS, or the provider's config export) rather than a web console, and add a CI check that every new record points at a host known to serve HTTPS — a CDN, a static host, or a load balancer with a managed certificate. Second, add every subdomain to the synthetic HTTPS checks the moment it is created, so a missing certificate alerts within minutes rather than when a reader reports it. Third, document the rule where agencies and other teams will see it: \"every name under example.com must serve valid HTTPS from its first request\". Most breakages under HSTS are not technical surprises; they are someone who never heard of the policy spinning up a quick landing page on a host that defaults to plain HTTP.",[14,777,778],{},"The same discipline makes certificate expiry less likely to matter. With HSTS active, browsers refuse to let readers click through a certificate warning, so an expired certificate on any subdomain becomes a hard outage rather than a scary-looking page. Automated renewal — standard on every static host and on Caddy — plus an expiry alert at fourteen days covers it.",[32,780,782],{"id":781},"measured-impact","Measured Impact",[384,784,785,798],{},[387,786,787],{},[390,788,789,792,795],{},[393,790,791],{},"Measure",[393,793,794],{},"Before",[393,796,797],{},"After (stage 5)",[406,799,800,811,822,833,842],{},[390,801,802,805,808],{},[411,803,804],{},"First requests sent over HTTP (edge logs, per day)",[411,806,807],{},"~4,100",[411,809,810],{},"~310 (first-time visitors only)",[390,812,813,816,819],{},[411,814,815],{},"After preload shipped in browsers (3 months later)",[411,817,818],{},"—",[411,820,821],{},"~40 (old browsers, bots)",[390,823,824,827,830],{},[411,825,826],{},"Subdomains reachable over HTTPS",[411,828,829],{},"12 of 14",[411,831,832],{},"12 of 12 (2 retired)",[390,834,835,838,840],{},[411,836,837],{},"Incidents during ramp",[411,839,818],{},[411,841,267],{},[390,843,844,847,850],{},[411,845,846],{},"securityheaders.com HSTS check",[411,848,849],{},"fail",[411,851,852],{},"pass",[244,854,855,919],{},[247,856,255,861,255,864,255,867,255,870],{"viewBox":857,"role":250,"ariaLabelledBy":858,"xmlns":254},"0 0 760 250",[859,860],"hsts-http-title","hsts-http-desc",[257,862,863],{"id":859},"Plain-HTTP first requests per day",[261,865,866],{"id":860},"Three bars: about 4,100 plain HTTP requests per day before HSTS, about 310 per day with a one-year HSTS header, coming only from first-time visitors, and about 40 per day once the domain shipped on the preload list.",[265,868],{"x":267,"y":267,"width":268,"height":869,"fill":270},"250",[272,871,275,872,275,875,275,880,275,883,275,889,275,893,275,897,275,901,275,905,275,909,275,913,275,916,255],{"style":274},[277,873,874],{"x":279,"y":280,"fill":281,"style":282},"Requests that left a device unencrypted, per day",[79,876],{"x1":359,"y1":877,"x2":359,"y2":878,"stroke":879,"style":294},"46","196","#d9e2ef",[277,881,882],{"x":286,"y":540,"fill":281,"style":318},"No HSTS",[265,884],{"x":359,"y":562,"width":885,"height":886,"rx":459,"fill":347,"opacity":887,"stroke":349,"style":888},"460","26","0.28","stroke-width:1px",[277,890,892],{"x":891,"y":540,"fill":281,"style":318},"700","4,100",[277,894,896],{"x":286,"y":895,"fill":281,"style":318},"130","HSTS 1 year",[265,898],{"x":359,"y":304,"width":899,"height":886,"rx":459,"fill":325,"opacity":900,"stroke":327,"style":888},"35","0.4",[277,902,904],{"x":903,"y":895,"fill":281,"style":318},"275","310",[277,906,908],{"x":286,"y":907,"fill":281,"style":318},"180","+ preload list",[265,910],{"x":359,"y":911,"width":474,"height":886,"rx":429,"fill":291,"opacity":912,"stroke":293,"style":888},"162","0.6",[277,914,286],{"x":915,"y":907,"fill":317,"style":318},"245",[277,917,918],{"x":279,"y":578,"fill":335,"style":336},"Edge logs, requests on port 80 per day, ~95,000 visits per day throughout",[367,920,921],{},"The header removes repeat visitors' plain-text requests; preload removes nearly all of the rest.",[32,923,925],{"id":924},"pitfalls-rollback","Pitfalls & Rollback",[37,927,928,937,943,949,955],{},[40,929,930,933,934,936],{},[611,931,932],{},"Skipping the subdomain inventory."," ",[18,935,65],{}," will find the forgotten HTTP-only host for you, in the worst way. Check certificate transparency logs, not just DNS.",[40,938,939,942],{},[611,940,941],{},"Setting a year on day one."," A mistake then costs a year. Ramp.",[40,944,945,948],{},[611,946,947],{},"Preloading a shared domain."," If other teams or agencies create subdomains, preload binds them too. Get agreement first.",[40,950,951,954],{},[611,952,953],{},"Header missing on error pages."," Verify redirects, 404s and assets, not just the homepage.",[40,956,957,960,961,964],{},[611,958,959],{},"Rollback:"," to back out, serve ",[18,962,963],{},"max-age=0",". Browsers that see it drop the policy immediately; those that never return keep it until expiry, which is exactly why the ramp keeps early stages short. Preload removal is a separate request at hstspreload.org and takes months.",[32,966,968],{"id":967},"conclusion","Conclusion",[14,970,971,972,975,976,978],{},"HSTS is a one-line header with a long memory. Inventory every subdomain from DNS and certificate transparency, fix or retire anything that cannot serve HTTPS, ramp ",[18,973,974],{},"max-age"," from minutes to a year over about seven weeks, and add ",[18,977,65],{}," only once the inventory is clean. Preload is the optional last step — the right choice for a domain one team fully controls, and a commitment to weigh carefully for one shared across many.",[32,980,982],{"id":981},"faq","FAQ",[984,985,987],"h3",{"id":986},"what-does-hsts-protect-against","What does HSTS protect against?",[14,989,990],{},"It stops browsers from ever connecting to your domain over plain HTTP after they have seen the header once. That closes the window where an attacker on the network could intercept the first HTTP request and redirect or modify it before the HTTPS redirect happens.",[984,992,994],{"id":993},"why-not-set-a-one-year-max-age-straight-away","Why not set a one-year max-age straight away?",[14,996,997],{},"Because browsers remember it for the full duration. If a subdomain or path turns out to need plain HTTP, readers who saw the header cannot reach it until the max-age expires. Starting with minutes and increasing in steps limits the damage of a mistake.",[984,999,1001],{"id":1000},"is-the-hsts-preload-list-reversible","Is the HSTS preload list reversible?",[14,1003,1004],{},"Technically yes, but slowly. Removal requests take effect only as browsers ship new versions, and users on older versions keep the entry for months. Treat preloading as a long-term commitment for the domain and all its subdomains.",[984,1006,1008],{"id":1007},"do-static-hosts-already-redirect-http-to-https","Do static hosts already redirect HTTP to HTTPS?",[14,1010,1011],{},"Most do, but a redirect alone still lets the first request go over HTTP. HSTS makes the browser upgrade the request itself before it leaves the device, and preload extends that to readers who have never visited.",[32,1013,1015],{"id":1014},"related","Related",[37,1017,1018,1026,1033,1040,1047],{},[40,1019,1020,933,1023,1025],{},[611,1021,1022],{},"Parent:",[26,1024,29],{"href":28}," — the rest of the header set.",[40,1027,1028,1032],{},[26,1029,1031],{"href":1030},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fcustom-domains-and-tls-on-cloudflare-pages\u002F","Custom Domains and TLS on Cloudflare Pages"," — getting HTTPS right before HSTS.",[40,1034,1035,1039],{},[26,1036,1038],{"href":1037},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fwriting-a-content-security-policy-for-a-static-site\u002F","Writing a Content Security Policy for a Static Site"," — the header that pairs with HSTS.",[40,1041,1042,1046],{},[26,1043,1045],{"href":1044},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fserving-a-static-site-with-caddy\u002F","Serving a Static Site with Caddy"," — automatic HTTPS when self-hosting.",[40,1048,1049,1053],{},[26,1050,1052],{"href":1051},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Frunning-smoke-tests-against-a-preview-url\u002F","Running Smoke Tests Against a Preview URL"," — asserting headers on every deploy.",[1055,1056,1057],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":73,"searchDepth":87,"depth":87,"links":1059},[1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1075],{"id":34,"depth":87,"text":35},{"id":59,"depth":87,"text":60},{"id":375,"depth":87,"text":376},{"id":601,"depth":87,"text":602},{"id":647,"depth":87,"text":648},{"id":768,"depth":87,"text":769},{"id":781,"depth":87,"text":782},{"id":924,"depth":87,"text":925},{"id":967,"depth":87,"text":968},{"id":981,"depth":87,"text":982,"children":1070},[1071,1072,1073,1074],{"id":986,"depth":105,"text":987},{"id":993,"depth":105,"text":994},{"id":1000,"depth":105,"text":1001},{"id":1007,"depth":105,"text":1008},{"id":1014,"depth":87,"text":1015},[1077,1080,1083,1084],{"name":1078,"item":1079},"Home","\u002F",{"name":1081,"item":1082},"Production-Ready Deployment & CI\u002FCD Workflows","\u002Fproduction-ready-deployment-cicd-workflows\u002F",{"name":29,"item":28},{"name":5,"item":1085},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fenabling-hsts-and-preload-safely\u002F","2026-09-18","Roll out Strict-Transport-Security in stages, audit every subdomain before includeSubDomains, and decide whether the HSTS preload list is worth its permanence.","md",[1090,1091,1092,1093],{"q":987,"a":990},{"q":994,"a":997},{"q":1001,"a":1004},{"q":1008,"a":1011},{},true,"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fenabling-hsts-and-preload-safely",{"title":5,"description":1087},"production-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fenabling-hsts-and-preload-safely\u002Findex","article","Q-FFrqoqmIMXTZHzGmaKnjJYMA4XBdErib06VxVJCWM",[1102,1105,1108,1111,1114,1117,1120,1123,1126,1129,1132,1135,1138,1141,1144,1147,1150,1153,1156,1159,1162,1165,1168,1171,1174,1177,1180,1183,1186,1189,1192,1195,1198,1201,1204,1207,1210,1213,1216,1219,1222,1225,1228,1231,1234,1237,1240,1243,1246,1249,1252,1255,1258,1261,1264,1267,1270,1273,1276,1279,1282,1285,1288,1291,1294,1297,1300,1303,1306,1309,1312,1315,1318,1321,1324,1327,1330,1333,1336,1339,1342,1345,1348,1351,1354,1357,1360,1363,1366,1369,1372,1375,1378,1381,1384,1387,1390,1393,1396,1399,1402,1405,1408,1411,1414,1417,1420,1423,1426,1429,1432,1435,1438,1441,1444,1446,1449,1452,1455,1458,1461,1464,1467,1470,1473,1476,1479,1482,1485,1488,1491,1494,1497,1500,1503,1506,1509,1512,1515,1518,1521,1524,1527,1530,1533,1535,1538,1541,1544,1547,1550,1553,1556,1559,1562,1565,1568,1571,1574,1577,1580,1583,1586,1588,1591,1592,1595,1597,1600,1603,1605,1608,1611,1614,1617,1619,1622,1625,1628,1631,1634,1637,1640],{"path":1103,"title":1104},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fastro-vs-eleventy-build-times-at-10000-pages","Astro vs Eleventy Build Times at 10,000 Pages",{"path":1106,"title":1107},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fchoosing-between-astro-and-eleventy-for-large-docs","Astro vs Eleventy for Large Docs (1000+ Pages)",{"path":1109,"title":1110},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fcontent-collections-vs-eleventy-data-cascade","Content Collections vs the Eleventy Data Cascade",{"path":1112,"title":1113},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites","Astro vs Eleventy for Documentation Sites",{"path":1115,"title":1116},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fshortcodes-vs-components-for-docs-authors","Shortcodes vs Components for Docs Authors",{"path":1118,"title":1119},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fastro-vs-eleventy-for-documentation-sites\u002Fsidebar-navigation-in-astro-and-eleventy","Sidebar Navigation in Astro and Eleventy",{"path":1121,"title":1122},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fcustomizing-starlight-without-forking-the-theme","Customizing Starlight Without Forking the Theme",{"path":1124,"title":1125},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fdocusaurus-vs-starlight-for-product-documentation","Docusaurus vs Starlight for Product Documentation",{"path":1127,"title":1128},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress","Docs Frameworks: Docusaurus, Starlight and VitePress",{"path":1130,"title":1131},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fmdx-vs-markdoc-for-docs-content","MDX vs Markdoc for Docs Content",{"path":1133,"title":1134},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fmigrating-from-mkdocs-to-starlight","Migrating from MkDocs to Starlight",{"path":1136,"title":1137},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fversioned-documentation-with-docusaurus","Versioned Documentation with Docusaurus",{"path":1139,"title":1140},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fdocs-frameworks-docusaurus-starlight-vitepress\u002Fvitepress-for-library-documentation","VitePress for Library Documentation",{"path":1142,"title":1143},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fhow-to-benchmark-hugo-vs-astro-build-speeds","How to Benchmark Hugo vs Astro Build Speeds",{"path":1145,"title":1146},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fhugo-partialcached-for-faster-builds","Hugo partialCached for Faster Builds",{"path":1148,"title":1149},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories","Hugo Build Times for Large Repositories",{"path":1151,"title":1152},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fprofiling-hugo-templates-with-template-metrics","Profiling Hugo Templates With Template Metrics",{"path":1154,"title":1155},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Freducing-hugo-memory-usage-on-ci-runners","Reducing Hugo Memory Usage on CI Runners",{"path":1157,"title":1158},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fhugo-build-times-for-large-repositories\u002Fspeeding-up-hugo-builds-with-render-hooks-and-caching","Speeding Up Hugo Builds with Render Hooks & Caching",{"path":1160,"title":1161},"\u002Fchoosing-the-right-static-site-generator-for-production","Choosing the Right Static Site Generator for Production",{"path":1163,"title":1164},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Feleventy-vs-jekyll-for-markdown-heavy-blogs","Eleventy vs Jekyll for Markdown-Heavy Blogs",{"path":1166,"title":1167},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem","Jekyll Plugin Ecosystem",{"path":1169,"title":1170},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Freplacing-jekyll-plugins-when-migrating-to-eleventy","Replacing Jekyll Plugins When Migrating to Eleventy",{"path":1172,"title":1173},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Frunning-jekyll-on-github-pages-without-plugins","Running Jekyll on GitHub Pages Without Plugins",{"path":1175,"title":1176},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Fspeeding-up-slow-jekyll-builds","Speeding Up Slow Jekyll Builds",{"path":1178,"title":1179},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fjekyll-plugin-ecosystem\u002Fupgrading-jekyll-and-ruby-versions-safely","Upgrading Jekyll and Ruby Versions Safely",{"path":1181,"title":1182},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fconverting-front-matter-at-scale-during-migration","Converting Front Matter at Scale During Migration",{"path":1184,"title":1185},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators","Migrating Between Static Site Generators",{"path":1187,"title":1188},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fkeeping-redirects-working-after-an-ssg-migration","Keeping Redirects Working After an SSG Migration",{"path":1190,"title":1191},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-a-docs-site-from-jekyll-to-hugo","Migrating a Docs Site From Jekyll to Hugo",{"path":1193,"title":1194},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-from-gatsby-to-astro","Migrating from Gatsby to Astro",{"path":1196,"title":1197},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-from-hugo-to-astro-without-breaking-urls","Migrating From Hugo to Astro Without Breaking URLs",{"path":1199,"title":1200},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fmigrating-wordpress-to-a-static-site-generator","Migrating WordPress to a Static Site Generator",{"path":1202,"title":1203},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fmigrating-between-static-site-generators\u002Fporting-shortcodes-and-includes-between-generators","Porting Shortcodes and Includes Between Generators",{"path":1205,"title":1206},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fhandling-dynamic-routes-in-nextjs-static-export","Handling Dynamic Routes in Next.js Static Export",{"path":1208,"title":1209},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites","Next.js Static Export for Content Sites",{"path":1211,"title":1212},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fmigrating-from-gatsby-to-nextjs-static-export","Migrating from Gatsby to Next.js Static Export",{"path":1214,"title":1215},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fnextjs-app-router-static-export-limitations","Next.js App Router Static Export Limitations",{"path":1217,"title":1218},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Fnextjs-static-export-vs-astro-for-marketing-sites","Next.js Static Export vs Astro for Marketing",{"path":1220,"title":1221},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fnextjs-static-export-for-content-sites\u002Foptimizing-images-in-nextjs-static-export","Optimizing Images in Next.js Static Export",{"path":1223,"title":1224},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fadding-pagefind-to-an-astro-site","Adding Pagefind to an Astro Site",{"path":1226,"title":1227},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fbuilding-a-lunr-index-at-build-time-in-eleventy","Building a Lunr Index at Build Time in Eleventy",{"path":1229,"title":1230},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites","Search for Static Sites",{"path":1232,"title":1233},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Findexing-hugo-sites-with-pagefind","Indexing Hugo Sites with Pagefind",{"path":1235,"title":1236},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fmultilingual-search-on-static-sites","Multilingual Search on Static Sites",{"path":1238,"title":1239},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fpagefind-vs-algolia-docsearch","Pagefind vs Algolia DocSearch",{"path":1241,"title":1242},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fsearch-for-static-sites\u002Fsearch-index-size-budgets-for-large-docs","Search Index Size Budgets for Large Docs",{"path":1244,"title":1245},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fbest-ssg-for-technical-writers-without-coding-experience","Best SSG for Non-Developer Technical Writers",{"path":1247,"title":1248},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fchoosing-an-ssg-for-api-reference-documentation","Choosing an SSG for API Reference Documentation",{"path":1250,"title":1251},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fevaluating-ssg-accessibility-defaults","Evaluating SSG Accessibility Defaults",{"path":1253,"title":1254},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix","SSG Framework Selection Matrix",{"path":1256,"title":1257},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fpicking-an-ssg-for-a-multi-language-documentation-site","Picking an SSG for a Multi-Language Docs Site",{"path":1259,"title":1260},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Fssg-selection-checklist-for-engineering-teams","SSG Selection Checklist for Engineering Teams",{"path":1262,"title":1263},"\u002Fchoosing-the-right-static-site-generator-for-production\u002Fssg-framework-selection-matrix\u002Ftotal-cost-of-ownership-for-static-site-generators","Total Cost of Ownership for Static Site Generators",{"path":1265,"title":1266},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fcache-busting-with-content-hashed-filenames","Cache Busting with Content-Hashed Filenames",{"path":1268,"title":1269},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs","CDN Caching Rules for SSGs",{"path":1271,"title":1272},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fpurging-the-cdn-cache-after-a-static-deploy","Purging the CDN Cache After a Static Deploy",{"path":1274,"title":1275},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fsetting-cache-control-headers-on-cloudflare-pages","Cache-Control Headers on Cloudflare Pages",{"path":1277,"title":1278},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fsetting-up-proper-cache-headers-on-netlify","Proper Cache Headers on Netlify for SSGs",{"path":1280,"title":1281},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcdn-caching-rules-for-ssgs\u002Fstale-while-revalidate-for-static-html","Stale-While-Revalidate for Static HTML",{"path":1283,"title":1284},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Feliminating-layout-shift-from-web-fonts","Eliminating Layout Shift From Web Fonts",{"path":1286,"title":1287},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-cookie-banners","Fixing CLS from Cookie Banners",{"path":1289,"title":1290},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-late-loading-embeds","Fixing CLS From Late-Loading Embeds",{"path":1292,"title":1293},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Ffixing-cls-from-sticky-headers-and-anchor-links","Fixing CLS from Sticky Headers and Anchor Links",{"path":1295,"title":1296},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites","Cumulative Layout Shift Fixes for Static Sites",{"path":1298,"title":1299},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Fmeasuring-cls-in-the-field-with-web-vitals-js","Measuring CLS in the Field With web-vitals.js",{"path":1301,"title":1302},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fcumulative-layout-shift-fixes-for-static-sites\u002Freserving-space-for-images-and-embeds-to-stop-layout-shift","Reserving Space for Images and Embeds",{"path":1304,"title":1305},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Ffont-display-optional-vs-swap","font-display: optional vs swap",{"path":1307,"title":1308},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites","Font Loading Strategies for Static Sites",{"path":1310,"title":1311},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fmetric-matched-fallback-fonts-with-size-adjust","Metric-Matched Fallback Fonts with size-adjust",{"path":1313,"title":1314},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fpreloading-fonts-without-double-downloads","Preloading Fonts Without Double Downloads",{"path":1316,"title":1317},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fself-hosting-google-fonts-to-eliminate-layout-shift","Self-Host Google Fonts to Eliminate Layout Shift",{"path":1319,"title":1320},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Ffont-loading-strategies-for-static-sites\u002Fsubsetting-variable-fonts-for-faster-first-render","Subsetting Variable Fonts for Faster First Render",{"path":1322,"title":1323},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fbuilding-an-image-cdn-pipeline-for-static-sites","Building an Image CDN Pipeline for Static Sites",{"path":1325,"title":1326},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fgenerating-open-graph-images-at-build-time","Generating Open Graph Images at Build Time",{"path":1328,"title":1329},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro","Image Optimization Pipelines in Astro",{"path":1331,"title":1332},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Flazy-loading-images-without-hurting-lcp","Lazy-Loading Images Without Hurting LCP",{"path":1334,"title":1335},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Foptimizing-webp-images-in-hugo-without-plugins","Optimizing WebP Images in Hugo Without Plugins",{"path":1337,"title":1338},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fresponsive-images-with-srcset-in-eleventy","Responsive Images with srcset in Eleventy",{"path":1340,"title":1341},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fimage-optimization-pipelines-in-astro\u002Fserving-avif-with-fallbacks-on-static-sites","Serving AVIF With Fallbacks on Static Sites",{"path":1343,"title":1344},"\u002Fperformance-optimization-core-web-vitals-for-ssgs","Core Web Vitals Optimization for SSGs",{"path":1346,"title":1347},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fastro-islands-vs-full-hydration-performance","Astro Islands vs Full Hydration Performance",{"path":1349,"title":1350},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fdeferring-hydration-with-client-visible-in-astro","Deferring Hydration with client:visible in Astro",{"path":1352,"title":1353},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fhow-to-reduce-bundle-size-in-eleventy-builds","How to Reduce Bundle Size in Eleventy Builds",{"path":1355,"title":1356},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering","JavaScript Hydration & Partial Rendering",{"path":1358,"title":1359},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Fmeasuring-inp-on-static-sites-with-real-user-monitoring","Measuring INP on Static Sites with RUM",{"path":1361,"title":1362},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fjavascript-hydration-partial-rendering\u002Freplacing-react-islands-with-web-components","Replacing React Islands with Web Components",{"path":1364,"title":1365},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Feliminating-render-blocking-css-on-static-sites","Eliminating Render-Blocking CSS on Static Sites",{"path":1367,"title":1368},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Ffixing-lcp-on-text-heavy-documentation-pages","Fixing LCP on Text-Heavy Documentation Pages",{"path":1370,"title":1371},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites","Largest Contentful Paint Optimization for Static Sites",{"path":1373,"title":1374},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Fmeasuring-lcp-subparts-with-devtools","Measuring LCP Subparts with DevTools",{"path":1376,"title":1377},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Foptimizing-lcp-on-astro-with-priority-hints","Optimizing LCP on Astro with Priority Hints",{"path":1379,"title":1380},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Flargest-contentful-paint-optimization-for-static-sites\u002Freducing-lcp-from-hero-images-on-static-sites","Reducing LCP from Hero Images on Static Sites",{"path":1382,"title":1383},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fcomparing-lab-and-field-data-with-crux","Comparing Lab and Field Data with CrUX",{"path":1385,"title":1386},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci","Performance Budgets and Lighthouse CI",{"path":1388,"title":1389},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Freducing-lighthouse-score-variance-in-ci","Reducing Lighthouse Score Variance in CI",{"path":1391,"title":1392},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Frunning-webpagetest-scripts-against-preview-deploys","Running WebPageTest Scripts Against Preview Deploys",{"path":1394,"title":1395},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fsetting-up-lighthouse-ci-for-a-static-site","Setting Up Lighthouse CI for a Static Site",{"path":1397,"title":1398},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Ftracking-bundle-size-per-pull-request","Tracking Bundle Size per Pull Request",{"path":1400,"title":1401},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fperformance-budgets-and-lighthouse-ci\u002Fwriting-a-performance-budget-that-fails-builds","Writing a Performance Budget That Fails Builds",{"path":1403,"title":1404},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fauditing-unused-preloads","Auditing Unused Preloads",{"path":1406,"title":1407},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed","Resource Hints and Navigation Speed",{"path":1409,"title":1410},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Finstant-navigation-with-speculation-rules","Instant Navigation with Speculation Rules",{"path":1412,"title":1413},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fpreconnect-vs-dns-prefetch-on-static-sites","Preconnect vs DNS-Prefetch on Static Sites",{"path":1415,"title":1416},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fprefetching-links-in-astro","Prefetching Links in Astro",{"path":1418,"title":1419},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fresource-hints-and-navigation-speed\u002Fview-transitions-on-multi-page-static-sites","View Transitions on Multi-Page Static Sites",{"path":1421,"title":1422},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Fauditing-third-party-scripts-with-lighthouse","Auditing Third-Party Scripts With Lighthouse",{"path":1424,"title":1425},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites","Third-Party Script Performance on Static Sites",{"path":1427,"title":1428},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Flazy-loading-youtube-embeds-on-static-sites","Lazy-Loading YouTube Embeds on Static Sites",{"path":1430,"title":1431},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Floading-google-tag-manager-without-hurting-inp","Loading Google Tag Manager Without Hurting INP",{"path":1433,"title":1434},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Frunning-third-party-scripts-in-a-web-worker-with-partytown","Running Third-Party Scripts in a Web Worker with Partytown",{"path":1436,"title":1437},"\u002Fperformance-optimization-core-web-vitals-for-ssgs\u002Fthird-party-script-performance-on-static-sites\u002Fself-hosting-analytics-to-cut-third-party-requests","Self-Hosting Analytics to Cut Third-Party Requests",{"path":1439,"title":1440},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fautomating-eleventy-deployments-with-cloudflare-pages","Automating Eleventy Deployments on Cloudflare Pages",{"path":1442,"title":1443},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fconfiguring-redirects-on-cloudflare-pages","Configuring Redirects on Cloudflare Pages",{"path":1445,"title":1031},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fcustom-domains-and-tls-on-cloudflare-pages",{"path":1447,"title":1448},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fdeploying-hugo-to-cloudflare-pages-and-workers","Deploying Hugo to Cloudflare Pages and Workers",{"path":1450,"title":1451},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup","Cloudflare Pages Edge Caching Setup",{"path":1453,"title":1454},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcloudflare-pages-edge-caching-setup\u002Fmigrating-from-cloudflare-pages-to-workers-static-assets","Migrating from Cloudflare Pages to Workers Static Assets",{"path":1456,"title":1457},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fchecking-links-in-pull-requests","Checking Links in Pull Requests",{"path":1459,"title":1460},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fdocs-as-code-review-workflow-for-writers","Docs-as-Code Review Workflow for Writers",{"path":1462,"title":1463},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Feditorial-checks-with-vale-in-ci","Editorial Checks with Vale in CI",{"path":1465,"title":1466},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams","Content Workflows for Documentation Teams",{"path":1468,"title":1469},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fscheduling-content-publication-with-cron-triggered-builds","Scheduling Content Publication With Cron-Triggered Builds",{"path":1471,"title":1472},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fcontent-workflows-for-documentation-teams\u002Fwiring-a-headless-cms-to-a-static-build","Wiring a Headless CMS to a Static Build",{"path":1474,"title":1475},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fbuilding-astro-sites-with-github-actions","Building Astro Sites with GitHub Actions",{"path":1477,"title":1478},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fcaching-node-modules-in-github-actions-for-faster-ssg-builds","Caching node_modules in GitHub Actions",{"path":1480,"title":1481},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fdeploying-to-github-pages-with-actions","Deploying to GitHub Pages with Actions",{"path":1483,"title":1484},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fdeploying-to-multiple-environments-from-one-workflow","Deploying to Multiple Environments From One Workflow",{"path":1486,"title":1487},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fhow-to-set-up-github-actions-for-hugo-deployments","GitHub Actions for Hugo Deployments",{"path":1489,"title":1490},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds","GitHub Actions for Automated SSG Builds",{"path":1492,"title":1493},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fgithub-actions-for-automated-ssg-builds\u002Fmatrix-builds-for-multi-site-monorepos","Matrix Builds for Multi-Site Monorepos",{"path":1495,"title":1496},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fcaching-hugo-builds-in-github-actions","Caching Hugo Builds in GitHub Actions",{"path":1498,"title":1499},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fenabling-incremental-builds-in-eleventy","Enabling Incremental Builds in Eleventy",{"path":1501,"title":1502},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fincremental-builds-in-astro-with-the-content-layer","Incremental Builds in Astro with the Content Layer",{"path":1504,"title":1505},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs","Incremental Builds and Build Caching for SSGs",{"path":1507,"title":1508},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fmeasuring-build-time-regressions-in-ci","Measuring Build-Time Regressions in CI",{"path":1510,"title":1511},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fremote-caching-with-turborepo-for-ssg-monorepos","Remote Caching with Turborepo for SSG Monorepos",{"path":1513,"title":1514},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fincremental-builds-and-build-caching-for-ssgs\u002Fsharing-build-cache-across-ci-runners","Sharing Build Cache Across CI Runners",{"path":1516,"title":1517},"\u002Fproduction-ready-deployment-cicd-workflows","Production-Ready Deployment & CI\u002FCD for SSGs",{"path":1519,"title":1520},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Falerting-on-cache-hit-ratio-drops","Alerting on Cache Hit Ratio Drops",{"path":1522,"title":1523},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fbuilding-a-core-web-vitals-dashboard-from-rum-data","Building a Core Web Vitals Dashboard from RUM Data",{"path":1525,"title":1526},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fcrawling-for-broken-links-on-a-schedule","Crawling for Broken Links on a Schedule",{"path":1528,"title":1529},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production","Monitoring Static Sites in Production",{"path":1531,"title":1532},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Flogging-404s-at-the-edge","Logging 404s at the Edge",{"path":1534,"title":515},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fmonitoring-static-sites-in-production\u002Fuptime-and-synthetic-checks-for-static-sites",{"path":1536,"title":1537},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fconfiguring-vercel-for-hugo-and-eleventy","Configuring Vercel for Hugo and Eleventy",{"path":1539,"title":1540},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies","Netlify vs Vercel Deployment Strategies",{"path":1542,"title":1543},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fnetlify-build-hooks-for-content-updates","Netlify Build Hooks for Content Updates",{"path":1545,"title":1546},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fnetlify-redirects-and-rewrites-for-static-sites","Netlify Redirects and Rewrites for Static Sites",{"path":1548,"title":1549},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fsetting-up-deploy-previews-on-netlify-for-every-pull-request","Netlify Deploy Previews for Every Pull Request",{"path":1551,"title":1552},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fnetlify-vs-vercel-deployment-strategies\u002Fvercel-isr-vs-static-generation-for-ssgs","Vercel ISR vs Static Generation for SSGs",{"path":1554,"title":1555},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fautomating-preview-deploy-pipelines-with-github-actions","Automating Preview Deploy Pipelines with GitHub Actions",{"path":1557,"title":1558},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fcleaning-up-stale-preview-deployments","Cleaning Up Stale Preview Deployments",{"path":1560,"title":1561},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests","Preview Environments for Pull Requests",{"path":1563,"title":1564},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fpassword-protecting-preview-deployments","Password-Protecting Preview Deployments",{"path":1566,"title":1567},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fpreviewing-headless-cms-drafts","Previewing Headless CMS Drafts",{"path":1569,"title":1570},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fpreview-environments-for-pull-requests\u002Fvisual-regression-testing-on-preview-deploys","Visual Regression Testing on Preview Deploys",{"path":1572,"title":1573},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Fatomic-deploys-vs-incremental-uploads","Atomic Deploys vs Incremental Uploads",{"path":1575,"title":1576},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Fcanary-releases-for-static-sites","Canary Releases for Static Sites",{"path":1578,"title":1579},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Ffeature-flags-on-static-sites","Feature Flags on Static Sites",{"path":1581,"title":1582},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites","Rollbacks and Deploy Safety for Static Sites",{"path":1584,"title":1585},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Frolling-back-a-bad-static-deploy-in-under-a-minute","Rolling Back a Bad Static Deploy in Under a Minute",{"path":1587,"title":1052},"\u002Fproduction-ready-deployment-cicd-workflows\u002Frollbacks-and-deploy-safety-for-static-sites\u002Frunning-smoke-tests-against-a-preview-url",{"path":1589,"title":1590},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fauditing-npm-dependencies-in-ssg-pipelines","Auditing npm Dependencies in SSG Pipelines",{"path":1096,"title":5},{"path":1593,"title":1594},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fhash-based-csp-for-inline-scripts-in-astro","Hash-Based CSP for Inline Scripts in Astro",{"path":1596,"title":29},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites",{"path":1598,"title":1599},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsecuring-deploy-credentials-with-github-oidc","Securing Deploy Credentials with GitHub OIDC",{"path":1601,"title":1602},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fsubresource-integrity-for-third-party-assets","Subresource Integrity for Third-Party Assets",{"path":1604,"title":1038},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fsecurity-headers-for-static-sites\u002Fwriting-a-content-security-policy-for-a-static-site",{"path":1606,"title":1607},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fclean-urls-and-trailing-slashes-on-s3","Clean URLs and Trailing Slashes on S3",{"path":1609,"title":1610},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fcloudfront-functions-for-redirects","CloudFront Functions for Redirects",{"path":1612,"title":1613},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fdeploying-a-static-site-to-s3-and-cloudfront","Deploying a Static Site to S3 and CloudFront",{"path":1615,"title":1616},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites","Self-Hosting Static Sites on S3, Nginx and Caddy",{"path":1618,"title":1045},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fserving-a-static-site-with-caddy",{"path":1620,"title":1621},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fserving-a-static-site-with-nginx","Serving a Static Site with Nginx",{"path":1623,"title":1624},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fself-hosting-static-sites\u002Fzero-downtime-deploys-with-symlink-swaps","Zero-Downtime Deploys with Symlink Swaps",{"path":1626,"title":1627},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fadding-a-contact-form-with-cloudflare-workers","Adding a Contact Form with Cloudflare Workers",{"path":1629,"title":1630},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fhandling-form-submissions-on-a-static-site","Handling Form Submissions on a Static Site",{"path":1632,"title":1633},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites","Serverless Functions for Static Sites",{"path":1635,"title":1636},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fnetlify-functions-vs-cloudflare-workers","Netlify Functions vs Cloudflare Workers",{"path":1638,"title":1639},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fprotecting-a-static-site-behind-authentication","Protecting a Static Site Behind Authentication",{"path":1641,"title":1642},"\u002Fproduction-ready-deployment-cicd-workflows\u002Fserverless-functions-for-static-sites\u002Fproxying-third-party-apis-from-an-edge-function","Proxying Third-Party APIs from an Edge Function",1789722847342]