Prompt: add the security headers you are missing
Six headers, no application changes, and a warning about the one that breaks sites.
Headers are instructions to the browser about what to allow. They require no application changes and are almost never present on an AI-built app.
Copy this into Cursor, Claude Code, Lovable or your builder
Add security headers to every response this app serves.
Set:
Content-Security-Policy: default-src 'self'; script-src 'self';
object-src 'none'; base-uri 'self'; form-action 'self';
frame-ancestors 'none'
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Rules:
- Ship the CSP as Content-Security-Policy-Report-Only first, so I can see
what it would block before it blocks anything.
- If inline scripts are required, use a per-request nonce. Do not add
'unsafe-inline' — it defeats the purpose of the header.
- Do NOT include upgrade-insecure-requests.
- Put this in the framework's header configuration, not in a meta tag —
several of these only work as real headers.
Show me the final configuration and the file it lives in.What your AI should do with it
- Headers configured server-side rather than as meta tags.
- CSP rolled out in report-only mode first.
- No 'unsafe-inline' quietly added to make things work.
How to check it worked
Check what you actually send
curl -sI https://YOURAPP.com | grep -iE \ 'content-security-policy|strict-transport|x-frame|x-content-type|referrer-policy|permissions-policy'
This is one check out of 40+
Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.
Check my site — free