Skip to content
Discussion options

You must be logged in to vote

For a GitHub Pages static portfolio site, implement these security headers via <meta http-equiv> tags:

  1. X-Content-Type-Options: nosniff — Prevents MIME type sniffing
  2. X-Frame-Options: DENY — Prevents clickjacking
  3. Content-Security-Policy — Restricts resource loading
  4. Referrer-Policy: strict-origin-when-cross-origin

Since GitHub Pages doesn't let you set server-side headers, these meta tags in <head> are the best alternative. I've implemented this on my own portfolio and it passes all security linters.

Replies: 1 comment

Comment options

Dev9269
Jul 28, 2026
Maintainer Author

You must be logged in to vote
0 replies
Answer selected by Dev9269
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
1 participant