Headers

Request and response header rules. Add, remove, or override headers per site.

Status: skeleton

Full content lands in a follow-up pass.

Defaults

The edge automatically adds:

• X-Viaduct-Site-ID — non-guessable site identifier (used for abuse reports without revealing your .onion)
• X-Viaduct-Abuse-Report — URL with site ID prefilled

The edge automatically strips from origin responses (so they don't leak through to clients):

• Server
• Via
• X-Powered-By
• X-Ms-* (Azure Storage origins)

Custom rules

Per-site rules can:

• Add a response header (e.g., custom Cache-Control, Strict-Transport-Security)
• Remove a response header
• Override a response header
• Add a request header on origin fetches (e.g., a static API key the origin expects)