security

To configure Cloudflare security headers for static HTML pages, create a standard site/_headers file to enforce strict Content Security Policy controls and robust baseline protections across all project pages by default.

Subresource Integrity (SRI) ensures external scripts and styles have not been tampered with. You enforce SRI by adding cryptographic integrity attributes to external script tags, preventing the execution of modified resources.

Secure HTML forms and protect emails on static sites by implementing honeypot forms to block bots, using third-party services for safe data handling, and applying email protection techniques to prevent address scraping.

The best way to prevent secrets from leaking into client-side code is to enforce a strict no-secrets policy, verifying that sensitive data and credentials are never included in static HTML or client-side scripts.

You do not need to manually add rel attributes to every external link for web security. The default secure template automatically safeguards external links by enforcing rel="noopener noreferrer" to prevent tab hijacking.

Run an HTML security audit checklist before deployment to verify configurations across all pages. The audit validates header setups, SRI enforcement, safe external links, and form security to ensure no vulnerabilities ship.