What are security headers?

SHORT ANSWER

Security headers are short instructions your website sends along with every page, telling the visitor's browser which protections to switch on. They block whole groups of attacks, like malicious scripts, hidden frames and downgrades to an unencrypted connection, with a few lines of configuration.

ON THIS PAGE

What it means Why it matters for vibe-coded apps Example How to check if your app has this problem How to fix it

What it means

Every time a browser loads your page, your server sends back the page plus some hidden notes called headers. Security headers are the notes that say things like 'only run scripts from my own site' or 'never show this page inside another site'.

Browsers already know how to enforce these rules. They just need you to ask. Most hosting platforms leave the headers off by default.

Why it matters for vibe-coded apps

Your app can work perfectly with no security headers at all, so nothing prompts you or the AI tool to add them.

IF THIS IS WRONG IN YOUR APP

Without a Content-Security-Policy, a single injected script can run freely.
Without clickjacking protection, another site can put yours in a hidden frame and trick people into clicking.
Without HSTS, a visitor on public Wi-Fi can be pushed onto an unencrypted version of your site.

Example

A Next.js site that sends no protective headers.

✕ RISKYThe browser gets the page and no instructions

HTTP/2 200
content-type: text/html
server: nginx/1.18.0

✓ SAFERThe site asks the browser to switch protections on

async headers() {
  return [{
    source: "/(.*)",
    headers: [
      { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains" },
      { key: "X-Content-Type-Options", value: "nosniff" },
      { key: "X-Frame-Options", value: "DENY" },
      { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
    ],
  }];
},

Content-Security-Policy is the most powerful header but needs testing, because it blocks anything you did not list.

How to check if your app has this problem

1Run a free check on your site. The security headers check lists which ones are missing.
2Or open your site, open the browser developer tools, go to the Network tab and click the first request to see its response headers.

The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.

Run a free scan →

How to fix it

1Add Strict-Transport-Security, X-Content-Type-Options, a frame protection and Referrer-Policy. These are safe for almost every site.
2Add a Content-Security-Policy. Start in report-only mode, then enforce it once nothing breaks.
3Set them in your framework config or hosting settings (Vercel, Netlify and Cloudflare all support custom headers).
4Run a check again to confirm.

FIX PROMPT · PASTE INTO YOUR AI TOOL

Add security headers to every response from my site: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin and a Permissions-Policy that turns off camera, microphone and location. Use my framework's or host's standard way to set headers. Don't add a Content-Security-Policy yet and don't change anything else.

Check if your app has this problem

Paste your website and we'll check for security headers issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.

Last updated October 14, 2026

What we check

Need help?

Not sure what this means for your app? Our team will explain it in plain English.

Contact support