Skip to content
VibeVigil
Log inSign up

Guides · VibeVigil

Which security headers should my app send?

Five headers help a public app: Content-Security-Policy, HSTS, framing protection, nosniff, and Referrer-Policy.

Scan a site you own. It is free. No account.

You see the report first. Saving the site is optional.

No account. The report is the next page.

Free, no account. We fetch the public page, its scripts, and a few well-known paths.

A security header is a note your server sends with the page. The browser uses it to block some attacks.

These five matter for most apps on Vercel or Netlify:

  • Content-Security-Policy limits where scripts and frames can load.
  • Strict-Transport-Security tells the browser to keep using HTTPS.
  • X-Frame-Options, or a frame-ancestors rule, stops other sites from putting your app in a hidden frame.
  • X-Content-Type-Options set to nosniff stops the browser from guessing a file type.
  • Referrer-Policy limits how much of the URL is sent to other sites.

Missing headers are not the same as a leaked key. They are still worth fixing. A scan lists each one that is missing and gives you a fix note.

Set them in your host config or in the app. Do not turn off protections to hide the warning.

The page explains the check. A scan uses your URL.

You see the report before you make an account.

Which security headers should my app send? · VibeVigil