Missing safety headers
Security headers are a few standard settings your server sends with every page. They tell the browser to block common attacks. AI tools focus on features and usually skip them, because the app looks and works the same either way. Here is what they do and how to add them.
What it means
Your site is missing a few standard safety settings that browsers use to block common attacks (like injecting scripts or embedding your site inside a fake one).
Why AI tools cause it
These are set once in your server or host config. AI tools focus on features and usually skip them, because the app looks and works the same without them.
How xlogs checks it
xlogs reads your live site's response headers and lists the protective ones that are missing.
Check your own app for this
How to fix it
The goal: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values.
- Add the missing headers (the affected spot) in your framework or host config
- Use strict-but-safe defaults
- Redeploy and confirm they appear
In my app (the spot the scan shows): missing safety headers. Please make this true: The response includes Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy, with safe values. Steps: Add the missing headers (the spot the scan shows) in your framework or host config; Use strict-but-safe defaults; Redeploy and confirm they appear. Then tell me exactly what you changed, and do not print any secret values back to me.
Then verify: After you deploy, xlogs re-reads your headers and confirms the missing ones are now present.
Full step-by-step fix guide, with a copy-paste block for each AI tool →
Common questions
Are missing security headers actually dangerous?
Not on their own, where they are a medium-severity gap rather than an emergency. They are defense in depth: they make attacks like script injection and clickjacking harder. Adding them is cheap and worth doing before launch, which is why the scan reports them calmly rather than as a critical.
Which security headers should I set?
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or a CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy. The scan lists which of these are missing on your app so you can add just those.