Guides / missing security headers

Missing security headers on your AI-built app (CSP, HSTS, X-Frame-Options)

Which HTTP security headers an AI-built app should send, how to check them, and copy-paste config for common hosts.

What it is

Security headers are short instructions your server sends with every page. They tell the browser to use HTTPS only (Strict-Transport-Security), which scripts may run (Content-Security-Policy), not to let other sites frame your app (X-Frame-Options or CSP frame-ancestors), and not to guess file types (X-Content-Type-Options). AI builders rarely add them. They don’t fix bugs in your code, but they make common attacks like clickjacking and injected scripts much harder.

How to check

1. Open developer tools, Network tab, click the first page request and look at Response Headers.
2. Look for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy.
3. Or run a free Cobalt Owl scan, which lists what’s missing.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

Add these security headers to every response of my app, using the right file for my host (for example public/_headers on Netlify or Cloudflare Pages, or vercel.json on Vercel): Strict-Transport-Security: max-age=31536000; includeSubDomains, a Content-Security-Policy suited to my app (start with Content-Security-Policy-Report-Only if unsure), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin. Make sure nothing in the app breaks.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• OWASP Secure Headers Project
• MDN: Content-Security-Policy
• MDN: Strict-Transport-Security
• Cloudflare Pages: Headers

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.