Guide
Missing security headers: CSP, HSTS, X-Frame-Options and more
Which HTTP security headers matter for a small web app, what each does, and how to add them on common hosts.
The headers that matter
Content-Security-Policy limits where scripts and other resources can load from, which reduces the impact of cross-site scripting.
Strict-Transport-Security tells browsers to always use HTTPS for your domain.
X-Frame-Options or CSP frame-ancestors stops other sites from framing yours (clickjacking).
X-Content-Type-Options: nosniff, Referrer-Policy and Permissions-Policy are low-effort hardening.
How to add them
Next.js on Vercel: return them from headers() in next.config. Netlify: a _headers file or netlify.toml. Express: the helmet middleware. Cloudflare: Transform Rules.
Start CSP in report-only mode if you're unsure, then tighten it.
How StackSiren checks
StackSiren makes a normal GET request to your home page and reads the response headers, the same ones any browser receives.