One of seven checks in the Full Scan

Security headers and SSL certificate check

Security headers are short instructions your server sends with every page. They tell browsers to always use HTTPS, to refuse to load your app inside someone else's frame, and to block scripts from places you did not approve. Most AI-built apps ship without them.

Which headers the check reads

  • Strict-Transport-Security, which keeps browsers on HTTPS
  • Content-Security-Policy, which limits where scripts can load from
  • X-Frame-Options or frame-ancestors, which stops clickjacking
  • X-Content-Type-Options, which stops browsers guessing file types
  • Referrer-Policy and Permissions-Policy, which limit what leaks to other sites

The certificate

The same request checks your SSL certificate: whether it is valid for your domain and how many days it has left. An expired certificate takes your app offline for most visitors.

How it gets fixed

The fix prompt lists each missing header with the value to set, and tells your builder to add them in the hosting config or the server that serves your pages.

Common questions

Are missing headers a serious problem?

On their own they rank as medium. They matter because they make other attacks harder, and they are usually a five-minute fix.

Guides on this topic

Run this check on your app.

The Full Scan runs all seven checks in parallel, read-only, and gives you a fix prompt for every finding.

The other six checks