diff --git a/website/CHANGELOG.md b/website/CHANGELOG.md
index cc43f37e..7334cb37 100644
--- a/website/CHANGELOG.md
+++ b/website/CHANGELOG.md
@@ -1,4 +1,10 @@
-## 2026-10-30 — the site moves to Cloudflare Pages (D35 / R-1228); the contact form posts to api.felhom.eu
+## 2026-11-07 — two response headers back on Cloudflare (`website/_headers`)
+
+- DooPlex's retired nginx copy sent `X-Frame-Options: SAMEORIGIN` and served `/scripts/` as `text/plain`; Cloudflare
+  Pages did neither since 2026-10-30 (measured: no X-Frame-Options, the installer as `application/x-sh`;
+  `X-Content-Type-Options: nosniff` Cloudflare already sends). `website/_headers` restores both.
+
+## 2026-10-30 — the site moves to Cloudflare Pages (D35 / R-1228); the contact form posts to api.felhom.eu
 
 - **D35 (operator yes 2026-10-23; the switch approved 2026-10-30).** The site is uploaded to the Cloudflare Pages project
   `felhom-site` by `scripts/publish-site-cloudflare.sh` (website from `main`, `/scripts/` from the installer tag). After
diff --git a/website/_headers b/website/_headers
new file mode 100644
index 00000000..87036595
--- /dev/null
+++ b/website/_headers
@@ -0,0 +1,8 @@
+# Cloudflare Pages header rules (R-1228 follow-up, 2026-11-07). These two headers were set by DooPlex's nginx copy
+# (retired 2026-11-07) and were missing on Cloudflare since the 2026-10-30 move: framing by another site, and the
+# installer shown as text in a browser so an operator can read it before running it.
+/*
+  X-Frame-Options: SAMEORIGIN
+
+/scripts/*
+  Content-Type: text/plain; charset=utf-8