diff --git a/docs/development.md b/docs/development.md
index 15dceca..4cb4e9a 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -104,7 +104,7 @@ To publish the page, sign in once with `pnpm exec wrangler login`, using the Clo
 pnpm site:deploy
 ```
 
-The command builds the site and deploys it as a Cloudflare Worker with static assets (`wrangler.jsonc`). The Worker serves `github-file-hider.ribeiro.engineer` as a custom domain, so Cloudflare manages its DNS record and certificate. `site/public/_headers` sets the security and cache headers.
+The command builds the site and deploys it as a Cloudflare Worker with static assets (`wrangler.jsonc`). The Worker serves `github-file-hider.ribeiro.engineer` as a custom domain, so Cloudflare manages its DNS record and certificate. `site/public/_headers` sets the security and cache headers. `Cache-Control: no-transform` on every response stops Cloudflare from changing the HTML, for example to inject its Web Analytics script, which the Content Security Policy would block.
 
 ## Manual test on the demo repository
 
diff --git a/site/public/_headers b/site/public/_headers
index c3fb957..16d3976 100644
--- a/site/public/_headers
+++ b/site/public/_headers
@@ -4,6 +4,8 @@
   Referrer-Policy: strict-origin-when-cross-origin
   Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
   Cross-Origin-Opener-Policy: same-origin
+  Cache-Control: public, max-age=0, must-revalidate, no-transform
 
 /assets/*
-  Cache-Control: public, max-age=31536000, immutable
+  ! Cache-Control
+  Cache-Control: public, max-age=31536000, immutable, no-transform