Security headers checker
Last updated
Enter a URL to see which security headers the site sends and which are missing or weak. The check reads the response headers of the homepage only, the same way a browser does, and explains how to add each missing header on Vercel, Netlify or your own server.
What each header does
| Header | Protects against |
|---|---|
| Strict-Transport-Security | Downgrade to plain HTTP on later visits |
| Content-Security-Policy | Injected scripts (cross-site scripting) and data theft |
| X-Content-Type-Options: nosniff | Browsers guessing a file is a script |
| frame-ancestors or X-Frame-Options | Clickjacking inside another site’s frame |
| Referrer-Policy | Full URLs, tokens included, leaking to other sites |
| Permissions-Policy | Embedded content using camera, microphone or location |
Questions
- Where do I add headers on Vercel?
- In next.config.js headers(), vercel.json "headers", or middleware. Each Defexity finding includes a prompt that tells your AI coding tool which file to change.
Related Defexity checks
- SEC-004: Missing or weak Strict-Transport-Security header
- SEC-005: Content-Security-Policy missing or permissive
- SEC-006: Missing X-Content-Type-Options: nosniff
- SEC-007: No clickjacking protection
- SEC-008: Referrer-Policy leaks full URLs
- SEC-009: Permissions-Policy uses an ignored syntax
- SEC-010: Server software version disclosed
Defexity reports potential risks it can see from outside your app. It is not a guarantee of security and not legal advice.