Guide
How to fix missing security headers
To fix missing security headers, set Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, and a Referrer-Policy on every response. Each closes a specific attack, and on a static host you add them in one config file.
What each header does
- Content-Security-Policy controls what scripts and resources can load, blocking injected code.
- X-Frame-Options: DENY stops your site being framed for clickjacking.
- X-Content-Type-Options: nosniff stops the browser guessing a file's type.
- Strict-Transport-Security forces HTTPS.
- Referrer-Policy limits what you leak in the referrer.
Each header closes a specific attack you otherwise leave open.
How to add them
On Vercel or Netlify, add a headers block to the config file and they apply to every response. On a Node server, set them on each reply. Set them once, globally, so no page is missed. Then scan the live site with Plaintext to confirm they are present on the deployed responses, since a config that is not deployed does nothing.
Frequently asked
Why do missing security headers matter?
Each missing header leaves a specific attack open: no frame protection allows clickjacking, no nosniff allows type confusion, no CSP allows injected scripts to run. They are quick to add and close real holes.
How do I add security headers to my site?
On a static host like Vercel, add a headers block to the config so they apply to every response. On a server, set them on each reply. Then scan the live URL to confirm they actually ship.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes AI code generators leave open. The first scan is free.
Scan my app