Security headers for AI-built apps: CSP, HSTS and friends in 10 minutes
Most AI-generated apps deploy with the host's defaults, which rarely include security headers. They take minutes to add and block whole classes of attacks.
| Header | Starting value |
|---|---|
| Content-Security-Policy | default-src 'self'; frame-ancestors 'none'; base-uri 'self' (then add your API domains) |
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=() |
On Netlify and Cloudflare Pages put them in a _headers file; on Vercel use vercel.json headers. Run LatchDog's free check to see which ones you are missing.
Check your app now
Free, read-only public check: no sign-up, no card. Headers and HTTPS only. Deep scan (leaked keys, open Supabase tables, .env/.git) after you verify you own the domain.