Security headers and HTTPS, set once for every response

Paste into any coding agent: Claude Code, Cursor, Codex, Copilot, Windsurf or Cline.

# Security headers and HTTPS, set once for every response

Security headers are the cheapest protection the production site can have: a few lines of config that stop clickjacking, MIME sniffing, protocol downgrades and many script injections. Set them once, in one place, for every response, and roll out the Content-Security-Policy in report-only mode first so nothing breaks on launch day.

Site: not given. Find the production URL in the project config, or ask me.

## Ground rules

1. Read before you write. Explore the parts of the codebase this job touches and tell me what is already in place.
2. Plan, then stop. Give me a numbered plan: what you will change, in which files, and why. Wait for my approval before editing anything.
3. Fix things at their source (the shared layout, the config, the generator), not with one-off patches page by page.
4. Keep the project's conventions: its framework APIs, file layout, naming and code style. Add no new dependency without asking.
5. Where something is already done well, say so and leave it alone.

## You will not

- Edit `.env` files, secrets or API keys, or print their values.
- Deploy, push, merge or publish anything.
- Delete data, or run migrations or scripts against a production database.
- Add tracking, third-party scripts or links to any site I did not ask for.
- Change copy, design or behaviour that this job does not need.
- Enable HSTS preload without my confirmation.
- Switch the CSP to enforcing mode on its own.

## Your stack

- Framework: Work out the framework, router and build output from the project files (package.json, lockfiles, framework config) before planning, and say which you found.
- Host: Work out where the site is hosted from the config files (vercel.json, netlify.toml, wrangler config, Dockerfile, fly.toml) and say which you found.

## Steps

### 1. See what is sent today

Find where response headers are set (framework config, middleware, the current host config, a CDN rule in the repository) and list the headers the homepage, an API route and a static asset send now. Note anything set in two places that could disagree.

### 2. HTTPS everywhere

Every HTTP request should redirect to HTTPS in one hop. Add `Strict-Transport-Security: max-age=31536000; includeSubDomains`. Only add `preload` if I confirm every subdomain serves HTTPS, because preloading is hard to undo.

### 3. The simple headers

Set on every HTML response, from one place:

- `X-Content-Type-Options: nosniff`
- `Referrer-Policy: strict-origin-when-cross-origin`
- `X-Frame-Options: DENY` (or `SAMEORIGIN` if the app frames itself), plus `frame-ancestors` in the CSP
- `Permissions-Policy` turning off what the site does not use, e.g. `camera=(), microphone=(), geolocation=()`
- Remove `X-Powered-By` and server version banners where the framework allows.

### 4. Content-Security-Policy, safely

Inventory every script, style, font, image, frame and fetch origin the site loads (analytics, payments, chat widgets, fonts, CDNs). Write a policy that allows exactly those, and ship it first as `Content-Security-Policy-Report-Only`. Where inline scripts are needed, prefer nonces or hashes over `'unsafe-inline'`; say plainly where the framework makes that hard. Tell me how to switch to the enforcing header once a few days show no violations.

## Done means

- [ ] HTTP redirects to HTTPS in one hop and HSTS is set.
- [ ] Every HTML response sends nosniff, a referrer policy, framing protection and a permissions policy.
- [ ] A Content-Security-Policy that lists every origin the site uses ships in report-only mode, with steps to enforce it.
- [ ] Headers are set in one place, and the site still works on every main page.

## Report back

When you finish, give me:

- what you changed, file by file;
- anything you skipped, and why;
- anything I must do by hand (DNS records, dashboards, accounts, deploys);
- how to check each change on the live site.