From f45dfaa232b47e1e11a537744bac74d2eb3b0163 Mon Sep 17 00:00:00 2001 From: Justin Date: Mon, 31 Aug 2026 14:13:19 -0500 Subject: [PATCH] Fix CSP blocking Cloudflare Insights beacon and inline scripts index.html carried two Content-Security-Policy meta tags that were never reconciled, so browsers enforced their intersection: the Cloudflare beacon script/connect endpoints, the profile photo from ki5bhv.com, and the page's own inline script/onerror handler all got silently blocked depending on which policy line was checked. Collapse index.html down to a single correct policy, and add the same static.cloudflareinsights.com / cloudflareinsights.com allowances to _headers (the actual Cloudflare Pages response header) and to k5bss.html's policy, since Cloudflare injects that beacon site-wide. Co-Authored-By: Claude Sonnet 5 --- _headers | 2 +- index.html | 3 +-- k5bss.html | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/_headers b/_headers index 41da39e..da309a5 100644 --- a/_headers +++ b/_headers @@ -1,5 +1,5 @@ /* - Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests + Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' https://ki5bhv.com data:; connect-src 'self' https://cloudflareinsights.com; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests X-Content-Type-Options: nosniff X-Frame-Options: DENY Referrer-Policy: strict-origin-when-cross-origin diff --git a/index.html b/index.html index 6ea86bc..e8c8b6e 100755 --- a/index.html +++ b/index.html @@ -6,9 +6,8 @@ - + content="default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' https://ki5bhv.com data:; connect-src 'self' https://cloudflareinsights.com; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests" /> Justin Frasier | Infrastructure Administrator diff --git a/k5bss.html b/k5bss.html index 73095e9..6efd992 100755 --- a/k5bss.html +++ b/k5bss.html @@ -5,7 +5,7 @@ - + K5BSS — Justin Frasier · Ham Radio Station