medium severity · fix guide
How to Add Missing Security Headers
Your site is missing a few standard safety settings that browsers use to block common attacks (like injecting scripts or embedding your site inside a fake one).
Why AI tools cause it
These are set once in your server or host config. AI tools focus on features and usually skip them, because the app looks and works the same without them.
The goal
The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values.
The steps
- Add the missing headers (the spot the scan shows) in your framework or host config
- Use strict-but-safe defaults
- Redeploy and confirm they appear
Fix it with your AI coding tool
Pick your tool and paste the instruction. It is written to make the goal above true, and to never print any secret values back to you.
Paste this to Any AI tool:
In my app (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Lovable:
In my Lovable app (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Cursor:
In my codebase (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Claude Code:
In my codebase (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Do it myself:
Goal: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; Redeploy and confirm they appear.
Then verify it worked
After you deploy, xlogs re-reads your headers and confirms the missing ones are now present.
Check your app for this issue
Free, read-only. Confirm the issue is present, then re-scan to prove your fix worked.