Missing HTTP Security Headers (HSTS, CSP, X-Frame-Options)

The web server does not return defensive HTTP headers (Strict-Transport-Security, X-Frame-Options, Content-Security-Policy).

Why This Issue Matters

Exposes users to clickjacking attacks, MIME-type sniffing exploits, and man-in-the-middle packet eavesdropping.

How to Fix This Issue in Code

Ready to copy

Next.js / React (App Router)

// next.config.ts
const nextConfig = {
  async headers() {
    return [
      {
        source: '/(.*)',
        headers: [
          { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
          { key: 'X-Frame-Options', value: 'DENY' },
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
        ],
      },
    ];
  },
};
export default nextConfig;

Standard HTML5

<!-- Note: Security headers must be sent by your web server/CDN, but meta equivalents can help for some rules: -->
<meta http-equiv="X-UA-Compatible" content="IE=edge" />

WordPress / PHP

# Add to .htaccess file:
<IfModule mod_headers.c>
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set X-Content-Type-Options "nosniff"
</IfModule>

Frequently Asked Questions

Does HTTPS automatically provide these security headers?

No. HTTPS encrypts traffic, but security headers instruct browsers on how to prevent cross-site framing and script tampering.

Check your website for missing http security headers (hsts, csp, x-frame-options)

Run an instant audit with ScanFix to detect this defect and other quality gaps across your pages.