Polish & Launch
Security Headers
Add the most important HTTP security headers to your Express server — Content Security Policy, X-Frame-Options, HSTS, and more — to protect against common web vulnerabilities.
💡Most of these protections are handled automatically by Airo AI's hosting. This prompt is here in case you need to verify them or if you've moved to custom hosting.
No fields needed.
This prompt covers all seven essential security headers. Copy it and paste it into Airo AI Builder — it will add them to your Express server and generate the appropriate hosting config file.
Heads up
Some headers (HSTS, CSP) may require adjustments depending on your hosting provider and whether your site uses HTTPS. The prompt includes notes on what to watch for.
Built something? Show it off in the Airo Builder Lab
Your Prompt
Add security headers to my site.
Note: Some of these headers must be set at the hosting or CDN level (e.g., Vercel, Netlify, Cloudflare, or your web server config). Where possible, also set them in the Express server if the app has one.
Add the following headers to every response:
1. Content-Security-Policy (CSP)
- Start with a reasonable default: default-src 'self'
- Allow scripts: script-src 'self' (add 'unsafe-inline' only if required by existing code)
- Allow styles: style-src 'self' 'unsafe-inline' (inline styles are common in React apps)
- Allow images from self and data URIs: img-src 'self' data: https:
- Allow fonts from self and Google Fonts if used: font-src 'self' https://fonts.gstatic.com
- Allow connections to self and any external APIs the app uses: connect-src 'self'
- Block all framing by default: frame-ancestors 'none'
- Report violations to the console during development
2. X-Frame-Options: DENY
Prevents the site from being embedded in an iframe on another domain (clickjacking protection).
3. X-Content-Type-Options: nosniff
Prevents browsers from MIME-sniffing a response away from the declared content type.
4. Referrer-Policy: strict-origin-when-cross-origin
Sends the full URL as referrer for same-origin requests; only the origin for cross-origin.
5. Permissions-Policy
Disable features the site doesn't use:
camera=(), microphone=(), geolocation=(), payment=(), usb=()
(Remove any that the site legitimately uses.)
6. Strict-Transport-Security (HSTS): max-age=31536000; includeSubDomains
Forces HTTPS for one year. Only add this if the site is served over HTTPS.
7. X-XSS-Protection: 0
Modern browsers ignore this, but setting it to 0 disables the buggy built-in XSS filter in older browsers.
Implementation:
- If the app has an Express server (src/server/), add a middleware function that sets all headers on every response. Place it near the top of the middleware stack, before routes.
- Also create a vercel.json / netlify.toml / _headers file (whichever matches the deployment target) with the same headers so they are set at the CDN edge as well.
- Do not break any existing functionality — if a header conflicts with something the app needs (e.g., CSP blocking an external script), adjust the policy rather than removing the header entirely.
Unfilled fields show as [brackets] — fill them in or leave as-is.