HTTP Headers (e.g. Content-Security-Policy) on Pages

[ThatBlockyPenguin]

Select Topic Area

Question

Body

Hi, I'm wondering if it's possible to set custom HTTP Headers on websites hosted on GitHub Pages? I know it's possible via the <meta> tag, which I am willing to use if it's the only way, but I'd rather use an actual header if possible.
Thanks!

[yoannchaudet]

We don't support this feature today so a meta tag unfortunately is the only way.

[ThatBlockyPenguin]

Ok, nevermind then. Thanks!

[nodeg]

@yoannchaudet Are there any plans to support his in the future? I find it quite important to be able to change/add those headers.

[yoannchaudet]

We want to get there eventually. No ETA unfortunately at the moment while this has not been prioritized.

[nodeg]

Alright. Thank you for the answer!

[TonioGela]

+1 on prioritizing this

[JandaSec]

can I also please vote for this feature. I need to add security headers to my site. Any site created with Github pages gets a Grade F score on https://securityheaders.io/ which is abysmal. Is there any update on the timescale for having this available please?

[ramalhais]

Need to add:
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

These are new security requirements for using SharedArrayBuffer in javascript.

[MeesJ]

This deserves much more attention. In the nowadays internet security headers are becoming more and more important. Currently GitHub Pages doesn't have the ability to add custom headers, making it impossible to adopt these security measures.

[TonioGela]

+1 again on this. Maybe adding a lot of comments will cause enough traffic for the feature to get prioritized.