Go-Live Clearance

Hardening · response headers

Security Headers Checker

Grade tools tell you "B". We tell you whether missing headers are a launch blocker or a post-ship warning — then give next.config / platform snippets you can paste.

Headers that matter at go-live

We score headers with a merge cap so one missing family does not nuke the whole clearance.

  • No Strict-Transport-Security

    Browsers may keep using HTTP on the next visit. On a paid or login site this is a trust gap.

  • Missing X-Frame-Options / frame-ancestors

    Clickjacking risk on marketing and auth pages. Cheap to add, expensive to explain after an incident.

  • No X-Content-Type-Options: nosniff

    MIME sniffing opens odd XSS paths on user-upload or CDN edges.

  • Empty or absent Content-Security-Policy

    Not always a DENIED blocker on day one — but it is the header security auditors ask for first.

  • Weak Referrer-Policy / Permissions-Policy

    Leaks URLs to third parties or leaves camera/mic defaults wide open.

Next.js / Vercel header snippet

next.config.js — headers()

/** @type {import('next').NextConfig} */
const nextConfig = {
  async headers() {
    return [
      {
        source: '/(.*)',
        headers: [
          { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'X-Frame-Options', value: 'DENY' },
          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
          { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
        ],
      },
    ]
  },
}

module.exports = nextConfig

CSP starter (tighten after measuring)

Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; script-src 'self'; style-src 'self' 'unsafe-inline'

Still check by hand

  • □Re-scan after deploy — Preview and Production can differ
  • □If you use a CDN, set headers at the edge once (avoid duplicates)
  • □Add a real CSP only after you inventory third-party scripts

Related