Security headers for AI-built apps: what to set

By Shinobi Tech, the team behind AppLeakWatch. Updated .

Security headers tell browsers how to protect your visitors. Start with Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and frame-ancestors. They don't fix bugs in your app, but they make common attacks harder.

Why this happens

Your app works the same with or without them, so neither you nor your AI tool gets a warning when they're missing.

How to check

  1. See what your site sends:
    curl -I https://yourdomain.com
  2. Look for each header above in the response.
  3. If a Content-Security-Policy includes unsafe-inline for scripts, it gives far less protection.

How to fix it

  1. Good starting values for most sites:
    Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
  2. Add a Content-Security-Policy, and try it in report-only mode first:
    Content-Security-Policy-Report-Only: default-src 'self'; frame-ancestors 'none'
  3. Set these in your host or framework config, then test every page, including payment and sign-in.

Prompt for your AI tool

Add production security headers to this app: HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and frame-ancestors. Start the CSP in report-only mode, list every outside domain the app needs, and tell me how to test it.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Can a strict CSP break my site?

Yes, it can block scripts you rely on. That's why report-only mode comes first.

Do headers replace access rules?

No. They protect browsers. Your data still needs login checks and database rules.

Related guides