medium severity · fix guide
How to Add Missing Security Headers
Your site is missing a few standard safety settings that browsers use to block common attacks (like injecting scripts or embedding your site inside a fake one).
Why AI tools cause it
These are set once in your server or host config. AI tools focus on features and usually skip them, because the app looks and works the same without them.
The goal
The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values, and the Content-Security-Policy restricts scripts: it has a script-src or default-src, and allows no 'unsafe-inline' script without a nonce or hash.
The steps
- Add the missing headers (the spot the scan shows) in your framework or host config
- Use strict-but-safe defaults
- For the Content-Security-Policy, set script-src (or default-src) and give inline scripts a per-request nonce instead of 'unsafe-inline'; Next.js middleware can generate one
- Redeploy and confirm they appear
Fix it with your AI coding tool
Pick your tool and paste the instruction. It is written to make the goal above true, and to never print any secret values back to you.
Paste this to Any AI tool:
In my app (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values, and the Content-Security-Policy restricts scripts: it has a script-src or default-src, and allows no 'unsafe-inline' script without a nonce or hash. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; For the Content-Security-Policy, set script-src (or default-src) and give inline scripts a per-request nonce instead of 'unsafe-inline'; Next.js middleware can generate one; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Paste this to Lovable:
In my Lovable app (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values, and the Content-Security-Policy restricts scripts: it has a script-src or default-src, and allows no 'unsafe-inline' script without a nonce or hash. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; For the Content-Security-Policy, set script-src (or default-src) and give inline scripts a per-request nonce instead of 'unsafe-inline'; Next.js middleware can generate one; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Paste this to Cursor:
In my codebase (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values, and the Content-Security-Policy restricts scripts: it has a script-src or default-src, and allows no 'unsafe-inline' script without a nonce or hash. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; For the Content-Security-Policy, set script-src (or default-src) and give inline scripts a per-request nonce instead of 'unsafe-inline'; Next.js middleware can generate one; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Paste this to Claude Code:
In my codebase (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values, and the Content-Security-Policy restricts scripts: it has a script-src or default-src, and allows no 'unsafe-inline' script without a nonce or hash. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; For the Content-Security-Policy, set script-src (or default-src) and give inline scripts a per-request nonce instead of 'unsafe-inline'; Next.js middleware can generate one; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Paste this to Do it myself:
Goal: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values, and the Content-Security-Policy restricts scripts: it has a script-src or default-src, and allows no 'unsafe-inline' script without a nonce or hash. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; For the Content-Security-Policy, set script-src (or default-src) and give inline scripts a per-request nonce instead of 'unsafe-inline'; Next.js middleware can generate one; Redeploy and confirm they appear.
Then verify it worked
After you deploy, xlogs re-reads your headers and reports which are still missing.
Check your app for this issue
Free, read-only. See whether the issue is detected, then rescan after your fix: the recheck says whether it is still detected.