cloudflare/headers
Checks that _headers holds only blocks of a path followed by indented name-value lines, and that the block for every path sets the content type, referrer, and framing headers.
Part of the cloudflare configuration, at the recommended level. It runs at the commit stage, once per scope. gspot runs this check itself.
Cloudflare skips a line it cannot read, and a static site has no server code to set these protections, so a typo or a missing line silently drops a security header.
What to do
Section titled “What to do”Write each block as a path, then indented lines of a name, a colon, and a value. Add each missing security header to the block for /*.
Example
Section titled “Example”An indented X-Frame-Options: DENY at the top of _headers reports a header with no path. Put a path such as /* on an unindented line above it.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore cloudflare/headers --paths "<glob>" --reason "<why>"