Check if your site has the right HTTP security headers configured to prevent common browser-level attacks.
Verifies Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
Canonical test payload dispatched during security surface audits.
Missing Content-Security-Policy and Strict-Transport-SecurityWatch the probe engine test this signature in an isolated sandbox.
Next.js Security Headers Config
// next.config.js without headers
const headers = [
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'X-Frame-Options', value: 'DENY' },
{ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
];Enforce modern security headers to eliminate clickjacking, MIME-sniffing, and protocol downgrade attacks.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for Security Headers Scanner.
Checks commonly evaluated alongside Security Headers Scanner during surface discovery.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect dangerous CORS policies that allow unauthorized third-party origins to invoke authenticated APIs.
Inspect parameter tampering and insecure direct object references across user-scoped data endpoints.
Audit your site across all 41 vectors automatically on every deploy.