No CSP, no HSTS, no X-Frame-Options: your AI-built page is missing security headers.

AI builders and no-code platforms rarely configure security headers. The result: no Content Security Policy, no HSTS, no clickjacking protection, no MIME sniffing guard. A page without headers looks unfinished to anyone who checks. Here's how to add them in 15 minutes.

How to fix: step by step

1. 1

   Check current headers

   Run `curl -I yourdomain.com` or use the Network tab in DevTools. Look for: content-security-policy, strict-transport-security, x-frame-options, x-content-type-options, referrer-policy, permissions-policy.

2. 2

   Add headers in Next.js config

   In next.config.ts, use the `headers()` function to set CSP, HSTS, and other headers. TrustDebt's scan includes a fix prompt with copy-paste config for your framework.

3. 3

   Start with a baseline CSP

   Don't lock down too aggressively at first. Start with `default-src 'self'` and add allowed sources as needed. Use CSP report-only mode to test before enforcing.

4. 4

   Add HSTS for HTTPS enforcement

   Set `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload` to enforce HTTPS for 2 years. Submit to the HSTS preload list for browsers.

5. 5

   Test and verify

   Use securityheaders.com or Mozilla Observatory to verify your headers. Re-scan with TrustDebt to confirm all headers are present and correctly configured.

Common questions