Base securitySeverity medium

Missing security headers

Six HTTP headers form a site's first line of defense against common browser-side attacks. None of them is enabled by default on most frameworks — they have to be added explicitly.

Content-Security-Policy (CSP)

Restricts the sources allowed to load scripts, styles, images, etc. Without CSP, a successful script injection (XSS) can execute arbitrary code in visitors' browsers.

Content-Security-Policy: default-src 'self'; script-src 'self'

Strict-Transport-Security (HSTS)

Forces the browser to always use HTTPS for your domain, even if a link or bookmark points to the HTTP version. Prevents a downgrade attack.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

X-Frame-Options

Prevents your site from being loaded in an <iframe> on another domain — protects against clickjacking (tricking a user into clicking your site without knowing it, hidden under another page).

X-Frame-Options: DENY

X-Content-Type-Options

Prevents the browser from guessing ("sniffing") a file's type differently from the declared Content-Type — a classic XSS vector when a file uploaded by a user gets reinterpreted as HTML/JS.

X-Content-Type-Options: nosniff

Referrer-Policy

Controls how much information about the current URL is sent to the destination site when a visitor clicks an outbound link — avoids leaking sensitive parameters in the URL.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy

Explicitly disables sensitive browser APIs (camera, microphone, geolocation) that your site doesn't use — reduces what a compromised third-party script could do.

Permissions-Policy: camera=(), microphone=(), geolocation=()

Adding them on Next.js

All at once, in next.config.js :

async headers() {
  return [
    {
      source: '/:path*',
      headers: [
        { key: 'Content-Security-Policy', value: "default-src 'self'; script-src 'self'" },
        { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains; preload' },
        { key: 'X-Frame-Options', value: 'DENY' },
        { key: 'X-Content-Type-Options', value: 'nosniff' },
        { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
        { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
      ],
    },
  ];
}

Check whether your site is affected by this vulnerability.

Scan my app