Add security headers with a plan for your site
Review response headers, understand which controls fit the application, and test policy changes before enforcing them.
For your setup.
Choose your platform. A report may suggest one from source or delivery hints; confirm it matches the website you control.
The general steps below work across platforms. Choose a setup above for supported code examples.
Why this matters
Response headers can tell browsers how to handle content and features. Their value depends on a policy that matches the site’s resources and deployment; a header’s presence alone does not prove that the policy is strong or correctly applied.
Inventory the current response
Check the final HTTPS response for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Confirm whether headers differ by route, redirect, or CDN edge.
Develop CSP from actual dependencies
List scripts, styles, fonts, images, frames, connections, and any inline code the site uses. Build a restrictive policy for that inventory rather than copying a generic allowlist. A policy that blocks legitimate resources can break the site.
Test before enforcing
Where supported by your delivery stack, deploy a Content-Security-Policy-Report-Only policy and review violations. Fix the dependency or refine the policy, then move to enforcement deliberately. Report-only policy does not itself block resources.
Roll out transport controls cautiously
Serve the whole site over HTTPS before enabling HSTS. Add `includeSubDomains` only if every covered subdomain is ready for HTTPS; preload is a separate commitment with removal delays. Choose other browser controls based on actual features and compatibility.
For your setup
Cloudflare
Response Header Transform Rules can set headers at the edge, but confirm that the active zone, rule order, and route scope match the deployed hostname. Check the final public response rather than relying only on dashboard configuration.
Next.js
Headers can be configured in the framework or hosting layer, but proxies may replace or append them. Test both direct and deployed responses and avoid duplicate CSP policies with unexpected cumulative restrictions.
Check your work
- Inspect the final response headers over HTTPS on representative routes.
- Test CSP in report-only mode and review violations before enforcing.
- Check all subdomains before adding HSTS includeSubDomains or preload.
- Test login, payments, embeds, fonts, analytics choices, and other site features after rollout.