netlify.toml

[build]
  # We publish the production build to an /api subdirectory so we can proxy
  # to it via the framer-site netlify project and have everything served
  # correctly at framer.com/api/
  command = "make publish"
  publish = "build"

# Redirect from framer-api.netlify.com -> /api to avoid 404
[[redirects]]
  from = "/"
  to = "/api/"

# Custom Motion 404 (Netlify defaults to 404.html in project root)
[[redirects]]
  from = "/motion/*"
  to = "/api/motion/404/"
  status = 404

# Custom 404 (Netlify defaults to 404.html in project root)
[[redirects]]
  from = "/*"
  to = "/api/404.html"
  status = 404

[[headers]]
  for = "/*"
  [headers.values]
    Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"
    X-Frame-Options = "deny"
    X-Content-Type-Options = "nosniff"
    X-XSS-Protection = "1; mode=block"
    Referrer-Policy = "strict-origin-when-cross-origin"