Common problem

Is your site missing security headers?

Security headers are short instructions your site sends to the browser. They help block common tricks, like loading your site in a hidden frame or running injected scripts.

Check your live app for free

Paste your link. The free summary usually takes under a minute.

How it happens

These headers aren't always added for you. Often you have to add them in your host's settings or your app's config.

What our scan checks

  • We check for Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options or frame-ancestors, X-Content-Type-Options and Referrer-Policy.
Example fix prompt

Fix prompt from a full report (missing X-Frame-Options)

Paste this into your AI builder
In my AI app builder (Lovable, Bolt, Cursor, Replit, v0 or similar):
Add this HTTP response header to every page of my site:

X-Frame-Options: DENY

Also add frame-ancestors 'none' to my Content-Security-Policy if I have one. If I need to embed my own site somewhere, use SAMEORIGIN instead.
If I'm on Vercel, add it in vercel.json under "headers" (or in next.config headers()). If I'm on Netlify, use a _headers file. Don't break anything that already works.

The full report gives a prompt like this for every issue it finds, written for your site.

This is an automated, surface-level check of what your site shows the public. It is not a full security audit.