netlify.toml

[[headers]]
  for = "/*"
  [headers.values]
  X-XSS-Protection = "1; mode=block"
  X-Frame-Options = "DENY"
  Referrer-Policy = "same-origin,strict-origin-when-cross-origin"
  X-Content-Type-Options = "nosniff"
  Report-To = '{"group":"default","max_age":31536000,"endpoints":[{"url":"https://travi.report-uri.com/a/d/g"}],"include_subdomains":true}'
  NEL = '{"report_to":"default","max_age":31536000,"include_subdomains":true}'
  Content-Security-Policy-Report-Only = "default-src 'none'; script-src 'self' www.google-analytics.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src fonts.gstatic.com; connect-src 'self' www.google-analytics.com; img-src 'self' www.google-analytics.com secure.gravatar.com; manifest-src 'self'; form-action 'none'; frame-ancestors 'none'; report-uri https://travi.report-uri.com/r/d/csp/wizard"

[[redirects]]
  from = "https://matt-travi.netlify.com/*"
  to = "https://matt.travi.org/:splat"
  force = true