The HTTP security headers every launch should validate
A practical header guide that reads like a launch checklist and keeps the remediation advice short enough to act on.
Header primer
CSP is the highest leverage header on the list
A good Content-Security-Policy reduces the blast radius of XSS and makes the browser a better gatekeeper. Start with a narrow policy and expand only where needed.
Quick fix
default-src 'self' and test in report-only mode before you enforce it.Clickjacking
Frame protection should be obvious and boring
If the site should never be embedded, say so directly. If you need to allow specific embeds, do it intentionally with a policy instead of leaving it open by accident.
- Use X-Frame-Options or an equivalent frame-ancestors rule.
- Prefer the policy that matches the actual embed requirement.
- Keep the remediation one line and easy to verify.
Transport
HSTS is a trust lock once HTTPS is stable
Only enable it after HTTPS is fully correct. The point is to force browsers back onto secure transport, not to paper over a broken certificate setup.
Quick fix
Strict-Transport-Security: max-age=31536000; includeSubDomains after you confirm the redirect path is clean.Browser hygiene
Nosniff is a cheap win
The nosniff header stops browsers from guessing content types. It is low risk, easy to explain, and should ship early in any baseline hardening pass.
- Add X-Content-Type-Options: nosniff.
- Treat it as a baseline control, not an advanced one.
- Use it to remove accidental browser behavior, not to compensate for weak uploads.
Launch order
The minimum viable header set should be sequenced
Some headers are safer to ship before others. Make the order part of the advice so the user does not have to guess what to do first.
Nosniff
Ship immediately. It is the easiest safe header to add.
Framing controls
Close clickjacking paths as soon as possible.
HSTS
Enable after HTTPS is correct across the public surface.
CSP report-only
Measure before you enforce.
Next action
Run the scanner against your own site
The article lands hardest when it turns into a fix list. Scan, close the gaps, and recheck.
Continue reading
More field notes
Security
Is VibeLeak safe to use? Report privacy, logs, and exports explained
A plain-English look at how VibeLeak scans public sites safely, what gets stored, who can see reports, and why full findings and Markdown exports stay owner-only.
Open articleSecurity
We Scanned the Moz Top 500. Even the Internet's Giants Are Missing the Basics.
VibeLeak ran its full trust surface scan against the Moz Top 500 most popular websites. This historical corpus still shows how common basic web security gaps are.
Open articleWorkflow
How to read a VibeLeak scan result
A VibeLeak scan returns a grade, a list of findings, and a percentile rank. Here is how to read each piece so you know what to fix first.
Open article