2026-10-26 · Daily security tips

Is your site missing basic security headers?

Security headers are small instructions your server sends with every page. Many AI-built and quickly deployed apps ship with none of them.

Check: open your live site, go to DevTools > Network, click the first request and read the Response Headers. Look for Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or a CSP frame-ancestors rule), X-Content-Type-Options: nosniff and Referrer-Policy.

Fix: add them in your host's config (vercel.json, netlify.toml, _headers) or your framework's headers setting. Start with nosniff, a referrer policy and frame protection, which rarely break anything. Roll out Content-Security-Policy carefully, in report-only mode first.

Headers are not a substitute for fixing leaked keys or open database tables, but they are cheap protection.