Erweiterte Header für Netlify konfigurieren

# netlify.toml — Erweiterte Security Header
[[headers]]
  for = "/*"
  [headers.values]
    Origin-Agent-Cluster = "?1"
    X-DNS-Prefetch-Control = "off"
    X-Download-Options = "noopen"
    X-Permitted-Cross-Domain-Policies = "none"

# _headers — Erweiterte Security Header
/*
  Origin-Agent-Cluster: ?1
  X-DNS-Prefetch-Control: off
  X-Download-Options: noopen
  X-Permitted-Cross-Domain-Policies: none

// netlify/edge-functions/security-headers.ts
import type { Context } from "https://edge.netlify.com";

export default async (request: Request, context: Context) => {
  const response = await context.next();

  // Erweiterte Header setzen
  response.headers.set("Origin-Agent-Cluster", "?1");
  response.headers.set("X-DNS-Prefetch-Control", "off");
  response.headers.set("X-Download-Options", "noopen");
  response.headers.set("X-Permitted-Cross-Domain-Policies", "none");

  // X-Powered-By entfernen (falls von Framework gesetzt)
  response.headers.delete("X-Powered-By");

  return response;
};

export const config = { path: "/*" };

# Alle Security Headers auf einmal prüfen
curl -sI https://ihre-domain.de | grep -iE \
  "strict-transport|x-frame|x-content-type|referrer-policy|permissions-policy|origin-agent|x-dns-prefetch|cross-origin|x-download|x-permitted"

# Erwartete Ausgabe (Auszug):
# strict-transport-security: max-age=31536000; includeSubDomains; preload
# x-frame-options: DENY
# x-content-type-options: nosniff
# referrer-policy: strict-origin-when-cross-origin
# origin-agent-cluster: ?1
# x-dns-prefetch-control: off

# X-Powered-By sollte NICHT erscheinen
curl -sI https://ihre-domain.de | grep -i x-powered-by

# Wolf-Agents Web Security Check nutzen:
# https://wolf-agents.com/tools/web-security-check