Security headers checker — HSTS, CSP & more
Missing security headers are one of the most common pre-launch failures on Vercel, Netlify, Webflow, and AI builder deploys. Check HSTS, CSP, frame protections, and related headers on your live origin.
Supabase backend testing (optional)
Provide Supabase credentials to run deeper RLS and cross-tenant isolation probes. Secrets are encrypted at rest and never appear in scan reports.
Expand to add optional Supabase credentials.
Headers to verify before launch
Strict-Transport-Security (HSTS) with a meaningful max-age
Content-Security-Policy tuned for your scripts and third parties
X-Frame-Options or CSP frame-ancestors to block clickjacking
X-Content-Type-Options: nosniff
Referrer-Policy and Permissions-Policy appropriate for your app
Why builders skip them
Platform defaults often omit custom headers on static or edge hosts
AI-generated apps focus on UI, not reverse-proxy configuration
Webflow and similar CMS hosts need Cloudflare or a proxy for CSP/HSTS
FAQ
Security headers checker questions
How do I check security headers on my website?
Scan your production URL with Launch Auditor (or inspect response headers in DevTools). Confirm HSTS, CSP, and frame protections are present on the origin users hit — not only on localhost.
Does missing CSP block launch?
A missing or weak CSP is often a high-priority finding. Launch Auditor ranks header gaps by launch impact so you can fix blockers before softer polish.