medium
How to add security headers to your app
The problem
AI-generated apps almost always ship without security headers, leaving you open to clickjacking, protocol downgrade and content-injection attacks. Adding them is quick and high-leverage.
Step by step
- 1
Add Strict-Transport-Security (HSTS)
Force HTTPS with Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
- 2
Add a Content-Security-Policy
Start restrictive and allowlist only the origins you actually load scripts, styles and frames from.
- 3
Add X-Content-Type-Options and X-Frame-Options
Set X-Content-Type-Options: nosniff and X-Frame-Options: DENY (or a frame-ancestors CSP) to stop sniffing and clickjacking.
- 4
Verify the result
Re-scan your URL after deploying to confirm the headers are present on the live response.
Want it verified, not just fixed?
Fixing it is step one. A ClearedToShip review confirms the fix actually holds and gives you a signed, insured clearance to launch. Join early access: