HTTP security headers are response headers that instruct the browser to enforce protections on your site: Content-Security-Policy limits what scripts can run, Strict-Transport-Security forces HTTPS, and X-Frame-Options stops your site being embedded for clickjacking. They are a cheap, high-value defense layer that most AI-generated apps ship without.
The ones that matter most
Content-Security-Policy is the strongest defense against cross-site scripting because it restricts which scripts the browser will execute. Strict-Transport-Security prevents downgrade to insecure HTTP. X-Frame-Options (or a frame-ancestors CSP directive) blocks clickjacking by stopping other sites from framing yours.
How to add them
Set them once at your framework or host level: a headers configuration in Next.js, middleware in Express, or your CDN's response-header settings. They apply to every response, so it is a one-time setup with broad payoff.
What this means for AI-generated code
Generated apps almost never include security headers, because nothing in a prompt asks for them and the app works fine without them. That leaves easy, well-understood attacks like cross-site scripting and clickjacking wide open on an otherwise functional app.
Common questions
Which security headers should I add first?
Start with three: Content-Security-Policy (restricts script sources), Strict-Transport-Security (forces HTTPS), and X-Frame-Options or frame-ancestors (blocks clickjacking). These cover the highest-risk surface with the smallest chance of breaking a working app.
Do security headers actually stop attacks?
Yes, in the specific attack classes they are designed for. HSTS prevents downgrade-to-HTTP attacks. CSP makes XSS much harder to exploit. X-Frame-Options blocks clickjacking entirely. They are not a substitute for fixing vulnerabilities, but they limit the damage if one exists.
Will adding a CSP break my site?
It depends on whether your site uses inline scripts or loads resources from third-party domains. Start in Content-Security-Policy-Report-Only mode to log violations without blocking, see what would break, then tighten the policy incrementally.