Site Response Headers

Manages HTTP RESPONSE HEADERS for the hosting website — the thing a static export cannot do for itself. It rolls out a Content-Security-Policy (Content-Security-Policy-Report-Only + Reporting-Endpoints first, reports reviewed, then enforced) and sets Permissions-Policy, Referrer-Policy, the Cross-Origin-* policies, X-Frame-Options or Access-Control-Allow-Origin. Headers apply to the WHOLE site and are added at the edge, so they are live within seconds and survive redeploys. mode='list' shows what is set; 'add' adds/updates the given fields; 'remove' deletes the named fields; 'replace' overwrites the whole set. `headers` is one per line, 'Field: value': Content-Security-Policy-Report-Only: default-src 'self'; report-to csp Reporting-Endpoints: csp="/_opus/csp-report" LONG CACHE FOR STATIC FILES: put a PATH PATTERN in front of the field and you can set Cache-Control for that path only — `/assets/* Cache-Control: public, max-age=31536000, immutable`. Hosted sites already cache assets for one day by default; this is how you raise it to a year for fingerprinted files, which is what PageSpeed's "use efficient cache lifetimes" asks for. Cache-Control is accepted ONLY with a path: site-wide it would cache the HTML too, and a content update would never reach visitors. Any other allowed field also takes an optional path. THE COLLECTOR IS BUILT IN — every hosted site serves `/_opus/csp-report` on its OWN origin. Point Reporting-Endpoints at that relative path (first-party, no third party ever sees visitor data, no CORS preflight). Then read what came in with site_csp_reports. Reports go to the site's own reporting endpoint, not to an outside service. For 'remove' just list the field names. Transport and baseline security headers (Strict-Transport-Security, X-Content-Type-Options, Content-Type, Set-Cookie, Cache-Control...) are NOT settable on purpose — a site cannot weaken its own security floor. confirm=false previews, confirm=true applies.