The five response headers worth setting
What each one stops, and where to put them.
What they are for
Content-Security-Policy limits which scripts can run, so an injected script does not execute. Strict-Transport-Security forces HTTPS after the first visit. X-Frame-Options stops your app being framed for clickjacking. X-Content-Type-Options stops browsers guessing file types. Referrer-Policy stops your URLs — and anything in them — leaking to sites your users click through to.
None of these fix an underlying bug. They reduce what a bug can be turned into.
Where to add them
Next.js: the headers() function in next.config.ts. Vite or any static host on Vercel: a headers array in vercel.json. Netlify: a _headers file or netlify.toml. Cloudflare Pages: a _headers file.
Set them once at the platform level rather than per route, or they drift.
Doing CSP without breaking your app
CSP is the one that takes care. Start with Content-Security-Policy-Report-Only and the policy you intend, watch the console for violations, fix them, then switch to the enforcing header.
Going straight to a strict enforcing policy on a real app usually breaks something visible, and the instinct is then to remove the header entirely.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site