chore: Fix redirected MDN URLs for HTTP headers docs

src/content/docs/cache/advanced-configuration/early-hints.mdx

@@ -37,7 +37,7 @@ Early Hints are only generated and cached:
 
 * For URIs with `.html`, `.htm`, or `.php` file extensions, or no file extension
 * On 200, 301, or 302 response return codes
-* When the response contains [link headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Link) with preconnect or preload rel types, such as `Link: </img/preloaded.png>; rel=preload`
+* When the response contains [link headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Link) with preconnect or preload rel types, such as `Link: </img/preloaded.png>; rel=preload`
 
 :::note
 

src/content/docs/cache/concepts/cache-control.mdx

@@ -31,7 +31,7 @@ A `Cache-Control` header can include a number of directives, and the directive d
 :::note[Note]
 
 
-For more information about `Cache-Control` directives at origin servers, refer to the [Mozilla Cache-Control documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control).
+For more information about `Cache-Control` directives at origin servers, refer to the [Mozilla Cache-Control documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control).
 
 
 :::

src/content/docs/cache/how-to/cache-keys.mdx

@@ -95,7 +95,7 @@ In the **Check if header contains** section, you can add header names and their
 
 To check for the presence of a header without including its actual value, use the **Check presence of** option.
 
-Currently, you can only exclude the `Origin` header. The `Origin` header is always included unless explicitly excluded. Including the [Origin header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin) in the Cache Key is important to enforce [CORS](https://developer.mozilla.org/en-US/docs/Glossary/CORS).
+Currently, you can only exclude the `Origin` header. The `Origin` header is always included unless explicitly excluded. Including the [Origin header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin) in the Cache Key is important to enforce [CORS](https://developer.mozilla.org/en-US/docs/Glossary/CORS).
 
 Additionally, you cannot include the following headers:
 

src/content/docs/cache/how-to/purge-cache/purge-by-single-file.mdx

@@ -12,7 +12,7 @@ For information on single-file purge rate limits, refer to the [limits](/cache/h
 A single-file purge performed through your Cloudflare dashboard does not clear objects that contain any of the following:
 
 - [Custom cache keys](/cache/how-to/cache-keys/)
-- [Origin header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin)
+- [Origin header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin)
 - Any of these request headers:
   - `X-Forwarded-Host`
   - `X-Host`

src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx

@@ -59,7 +59,7 @@ The selector options are:
 * **Lax** - Cookies are allowed to be sent with top-level navigations and will be sent along with GET requests initiated by third party websites.
 * **Strict** - Cookies will only be sent in a first-party context and not be sent along with requests initiated by third party websites.
 
-Refer to the [Mozilla documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite) for more information.
+Refer to the [Mozilla documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) for more information.
 
 #### When not to use SameSite
 

src/content/docs/cloudflare-one/insights/dex/tests/http.mdx

@@ -51,7 +51,7 @@ An HTTP test measures the following data:
 | Resource fetch time  | Total time of all steps of the request, measured from [`startTime` to `responseEnd`](https://developer.mozilla.org/en-US/docs/Web/API/Performance_API/Resource_timing). |
 | Server response time | Round-trip time for the device to receive a response from the target.                                                                                                   |
 | DNS response time    | Round-trip time for the DNS query to resolve.                                                                                                                           |
-| HTTP status codes    | [Status code](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status) returned by the target.                                                                         |
+| HTTP status codes    | [Status code](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status) returned by the target.                                                                         |
 
 ## Related resources
 

src/content/docs/ddos-protection/managed-rulesets/http/override-parameters.mdx

@@ -48,7 +48,7 @@ The action that will be performed for requests that match specific rules of Clou
   - API value: _N/A_ (internal rule action that you cannot use in overrides).
   - Closes ongoing HTTP connections. This action does not block a request, but it forces the client to reconnect. For HTTP/2 and HTTP/3 connections, the connection will be closed even if it breaks other requests running on the same connection.
   - The performed action depends on the HTTP version:
-    - HTTP/1: set the [`Connection` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection#directives) to `close`.
+    - HTTP/1: set the [`Connection` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Connection#directives) to `close`.
     - HTTP/2: send a [`GOAWAY` frame](https://datatracker.ietf.org/doc/html/rfc7540#section-6.8) to the client.
 
 - **DDoS Dynamic**

src/content/docs/page-shield/policies/csp-directives.mdx

@@ -51,5 +51,5 @@ The following table lists the supported CSP directives and special values you ca
 
 For more information on CSP directives and their values, refer to the following resources in the MDN documentation:
 
-* [Content-Security-Policy response header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
-* [CSP source values](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources)
+* [Content-Security-Policy response header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy)
+* [CSP guide](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP)

src/content/docs/page-shield/reference/csp-header.mdx

@@ -30,4 +30,4 @@ Configuring [log policies](/page-shield/policies/) will add other CSP report-onl
 
 ## Related resources
 
-- [Mozilla Developer Network's (MDN) documentation on Content-Security-Policy-Report-Only](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only)
+- [Mozilla Developer Network's (MDN) documentation on Content-Security-Policy-Report-Only](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy-Report-Only)

src/content/docs/page-shield/reference/page-shield-api.mdx

@@ -450,7 +450,7 @@ This `POST` request creates a Page Shield policy with _Log_ action, defining the
 
 All other scripts would trigger a policy violation, but those scripts would not be blocked.
 
-For more information on <GlossaryTooltip term="content security policy (CSP)">Content Security Policy (CSP)</GlossaryTooltip> directives and values, refer to the [MDN documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).
+For more information on <GlossaryTooltip term="content security policy (CSP)">Content Security Policy (CSP)</GlossaryTooltip> directives and values, refer to the [MDN documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy).
 
 :::note
 

src/content/docs/pages/configuration/early-hints.mdx

@@ -6,7 +6,7 @@ title: Early Hints
 
 [Early Hints](/cache/advanced-configuration/early-hints/) help the browser to load webpages faster. Early Hints is enabled automatically on all `pages.dev` domains and custom domains.
 
-Early Hints automatically caches any [`preload`](https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/preload) and [`preconnect`](https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/preconnect) type [`Link` headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Link) to send as Early Hints to the browser. The hints are sent to the browser before the full response is prepared, and the browser can figure out how to load the webpage faster for the end user. There are two ways to create these `Link` headers in Pages:
+Early Hints automatically caches any [`preload`](https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/preload) and [`preconnect`](https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/preconnect) type [`Link` headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Link) to send as Early Hints to the browser. The hints are sent to the browser before the full response is prepared, and the browser can figure out how to load the webpage faster for the end user. There are two ways to create these `Link` headers in Pages:
 
 ## Configure Early Hints
 

src/content/docs/r2/api/s3/extensions.mdx

@@ -35,7 +35,7 @@ If using Unicode in object key names, refer to [Unicode Interoperability](/r2/re
 
 ## Auto-creating buckets on upload
 
-If you are creating buckets on demand, you might initiate an upload with the assumption that a target bucket exists. In this situation, if you received a `NoSuchBucket` error, you would probably issue a `CreateBucket` operation. However, following this approach can cause issues: if the body has already been partially consumed, the upload will need to be aborted. A common solution to this issue, followed by other object storage providers, is to use the [HTTP `100`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/100) response to detect whether the body should be sent, or if the bucket must be created before retrying the upload. However, Cloudflare does not support the HTTP `100` response. Even if the HTTP `100` response was supported, you would still have additional latency due to the round trips involved.
+If you are creating buckets on demand, you might initiate an upload with the assumption that a target bucket exists. In this situation, if you received a `NoSuchBucket` error, you would probably issue a `CreateBucket` operation. However, following this approach can cause issues: if the body has already been partially consumed, the upload will need to be aborted. A common solution to this issue, followed by other object storage providers, is to use the [HTTP `100`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100) response to detect whether the body should be sent, or if the bucket must be created before retrying the upload. However, Cloudflare does not support the HTTP `100` response. Even if the HTTP `100` response was supported, you would still have additional latency due to the round trips involved.
 
 To support sending an upload with a streaming body to a bucket that may not exist yet, upload operations such as `PutObject` or `CreateMultipartUpload` allow you to specify a header that will ensure the `NoSuchBucket` error is not returned. If the bucket does not exist at the time of upload, it is implicitly instantiated with the following `CreateBucket` request:
 
@@ -59,7 +59,7 @@ Add a `cf-create-bucket-if-missing` header with the value `true` to implicitly c
 
 ### Conditional operations in `PutObject`
 
-`PutObject` supports [conditional uploads](https://developer.mozilla.org/en-US/docs/Web/HTTP/Conditional_requests) via the [`If-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Match), [`If-None-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-None-Match), [`If-Modified-Since`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since), and [`If-Unmodified-Since`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since) headers. These headers will cause the `PutObject` operation to be rejected with `412 PreconditionFailed` error codes when the preceding state of the object that is being written to does not match the specified conditions.
+`PutObject` supports [conditional uploads](https://developer.mozilla.org/en-US/docs/Web/HTTP/Conditional_requests) via the [`If-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-Match), [`If-None-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-None-Match), [`If-Modified-Since`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-Modified-Since), and [`If-Unmodified-Since`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-Unmodified-Since) headers. These headers will cause the `PutObject` operation to be rejected with `412 PreconditionFailed` error codes when the preceding state of the object that is being written to does not match the specified conditions.
 
 ## CopyObject
 

src/content/docs/r2/buckets/cors.mdx

@@ -91,7 +91,7 @@ The following fields in an R2 CORS policy map to HTTP response headers. These re
 | `AllowedOrigins` | Specifies the value for the `Access-Control-Allow-Origin` header R2 sets when requesting objects in a bucket from a browser.                                                                                                                                                                                                                                          | If a website at `www.test.com` needs to access resources (e.g. fonts, scripts) on a [custom domain](/r2/buckets/public-buckets/#custom-domains) of `static.example.com`, you would set `https://www.test.com` as an `AllowedOrigin`. |
 | `AllowedMethods` | Specifies the value for the `Access-Control-Allow-Methods` header R2 sets when requesting objects in a bucket from a browser.                                                                                                                                                                                                                                         | `GET`, `POST`, `PUT`                                                                                                                                                                                                                 |
 | `AllowedHeaders` | Specifies the value for the `Access-Control-Allow-Headers` header R2 sets when requesting objects in this bucket from a browser.Cross-origin requests that include custom headers (e.g. `x-user-id`) should specify these headers as `AllowedHeaders`.                                                                                                                | `x-requested-by`, `User-Agent`                                                                                                                                                                                                       |
-| `ExposeHeaders`  | Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the [safelisted response headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers#examples), such as `Content-Encoding` or `cf-cache-status`, you must specify it here. | `Content-Encoding`, `cf-cache-status`, `Date`                                                                                                                                                                                        |
+| `ExposeHeaders`  | Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the [safelisted response headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Expose-Headers#examples), such as `Content-Encoding` or `cf-cache-status`, you must specify it here. | `Content-Encoding`, `cf-cache-status`, `Date`                                                                                                                                                                                        |
 | `MaxAgeSeconds`  | Specifies the amount of time (in seconds) browsers are allowed to cache CORS preflight responses. Browsers may limit this to 2 hours or less, even if the maximum value (86400) is specified.                                                                                                                                                                         | `3600`                                                                                                                                                                                                                               |
 
 ## Example

src/content/docs/radar/investigate/http-requests.mdx

@@ -68,7 +68,7 @@ Mobile devices tend to be considerably more present when examining human generat
 
 :::note
 
-Note that device classification comes from the [User-agent](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent) header. Ultimately, this classification depends on the user agent(s) that bots use.
+Note that device classification comes from the [User-agent](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/User-Agent) header. Ultimately, this classification depends on the user agent(s) that bots use.
 :::
 
 For more information refer to [Get device types time series](/api/resources/radar/subresources/http/subresources/timeseries_groups/methods/device_type/).

src/content/docs/radar/investigate/url-scanner.mdx

@@ -66,7 +66,7 @@ Here's an example request body with some custom configuration options:
 
 Above, the visibility level is set as `Unlisted`, which means that the scan report won't be included in the [recent scans](https://radar.cloudflare.com/scan#recent-scans) list nor in search results. In  effect, only users with knowledge of the scan ID will be able to access it.
 
-There will also be three screenshots taken of the webpage, one per target device type. The [`User-Agent`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent) will be set as "XXX-my-user-agent". Note that you can set any custom HTTP header, including [Authorization](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization).
+There will also be three screenshots taken of the webpage, one per target device type. The [`User-Agent`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/User-Agent) will be set as "XXX-my-user-agent". Note that you can set any custom HTTP header, including [Authorization](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization).
 
 :::note[Header]
 Successful scans are subject to a retention policy of 12 months. Failed scans older than 30 days will be deleted.

src/content/docs/rules/snippets/examples/security-headers.mdx

@@ -74,7 +74,7 @@ export default {
 ## Other common security headers
 
 - Content-Security-Policy headers: Enabling these headers will permit content from a trusted domain and all its subdomains.
-  Refer to [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) for details.
+  Refer to [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy) for details.
 
 ```js
 "Content-Security-Policy": "default-src 'self' example.com *.example.com",
@@ -92,13 +92,13 @@ export default {
 "Permissions-Policy": "interest-cohort=()",
 ```
 
-- X-XSS-Protection header: Prevents a page from loading if an XSS attack is detected. Refer to [X-XSS-Protection](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection) for details.
+- X-XSS-Protection header: Prevents a page from loading if an XSS attack is detected. Refer to [X-XSS-Protection](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection) for details.
 
 ```js
 "X-XSS-Protection": "0",
 ```
 
-- X-Frame-Options header: Prevents click-jacking attacks. Refer to [X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).
+- X-Frame-Options header: Prevents click-jacking attacks. Refer to [X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options).
 
 ```js
 "X-Frame-Options": "DENY",