// Security headers

Security headers config for every host

Every host sets response headers in a different place. Pick yours for a config block you can paste, then check the result on your live site.

• Security headers for Next.jsAdd an async headers() function to next.config.ts that returns your security headers for the source "/:path*", and every route will send them. For a Content-Security-Policy that actually stops injected scripts, generate a nonce per request in proxy.ts instead of hard-coding the policy.
• Security headers on VercelAdd a "headers" array to vercel.json in your project root with the source "/(.*)" and your security headers, then redeploy. For Next.js apps on Vercel, set them in next.config.ts or proxy.ts instead so the config lives with the framework.
• Security headers on NetlifyCreate a file called _headers in your site's publish directory with a /* rule listing your security headers, or add a [[headers]] block to netlify.toml. For a Vite or React app, putting _headers in the public folder gets it copied into the publish directory on every build.
• Security headers on CloudflareFor any site proxied through Cloudflare, create a Response Header Transform Rule that sets each security header on all incoming requests. For Cloudflare Pages, a _headers file in your build output does the same job, and HSTS has its own switch under SSL/TLS.
• Security headers for ExpressInstall Helmet and call app.use(helmet()) before your routes; it sets HSTS, a strict CSP, frame protection, nosniff and a Referrer-Policy, and removes X-Powered-By. If you'd rather not add a dependency, a small middleware that calls res.setHeader for each header does the same job.
• Security headers for nginxAdd one add_header line per security header, each ending in always, inside the server block that listens on port 443. Any location block with its own add_header drops every header inherited from the server block, so repeat them there or keep them in an included file.