Missing security headers on your app: what they do and how to add them
Security headers like CSP, HSTS, and X-Frame-Options are cheap defenses your AI builder probably skipped. Here is what each one prevents and how to add them.
HTTP response headers are a free layer of defense, and AI-built apps almost always ship without them. They do not fix a leaked secret, but they reduce the blast radius of common attacks.
The ones that matter
- Content-Security-Policy (CSP) — limits what scripts can run, the main defense against cross-site scripting (XSS).
- Strict-Transport-Security (HSTS) — forces HTTPS so a visitor can't be downgraded to http.
- X-Frame-Options / frame-ancestors — stops your app being embedded in an attacker's iframe (clickjacking).
- X-Content-Type-Options: nosniff — stops browsers guessing content types.
- Secure cookie flags (
Secure,HttpOnly,SameSite) and avoiding mixed content (http resources on an https page).
How to add them
You usually don't touch app code — you add headers at the host. On Vercel/Next use vercel.json or next.config.js headers; on Netlify/Cloudflare use a _headers file. Shipshape's fix pack emits the exact config file for your platform.
FAQ
Are missing security headers a critical problem?
On their own they are usually a hardening gap, not a breach — but they make XSS, clickjacking, and downgrade attacks far easier, and they are trivial to add.
Do I need to change my app code to add headers?
Usually no. Headers are set at the host with a config file (vercel.json, next.config.js, or a _headers file). Shipshape generates the right one for your platform.
What is a good first header to add?
A Content-Security-Policy is the highest-impact, since it is the primary defense against cross-site scripting. Start strict and loosen only what you need.
Related questions
- CORS misconfiguration: when "Access-Control-Allow-Origin: *" is dangerous
- Exposed source maps: your original source code is downloadable
- Unvalidated postMessage: a cross-window message handler without an origin check
- Subdomain takeover: a dangling DNS record an attacker can claim