for Next.js apps

Next.js security headers check

No signup 路 no repo or GitHub access needed 路 passive, read-only checks 路 results in under a minute

See a sample report

Paste your link and see which security headers your Next.js app is missing, with the fix for each. Under a minute, no sign-up.

Only scan apps you own or have permission to scan.

why.txt

Why headers matter

Security headers tell browsers how to treat your site: always use HTTPS, which scripts may run, whether it can be framed. Next.js doesn't add most of them for you.

what_we_check.log

What the free scan checks

  • Security headers and CORS

    HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.

  • Leaked keys in your frontend

    Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.

  • Files left on the server

    Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.

  • Public source maps

    We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.

checklist.txt

Add headers in Next.js

  1. Open next.config.js. Add an async headers() function that returns headers for all routes.
  2. Start with HSTS. Strict-Transport-Security with a long max-age.
  3. Add the simple ones. X-Content-Type-Options: nosniff, Referrer-Policy and X-Frame-Options (or CSP frame-ancestors).
  4. Add a Content-Security-Policy. Start strict and loosen only what your app needs.
  5. Avoid wildcard CORS with credentials. Return a specific origin instead of *.
  6. Run the free scan. Confirm the headers show up on your live site.
faq.txt

FAQ

Which headers do you check?
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy, and wildcard CORS combined with credentials.
Do you grade my CSP?
No. We check that a Content-Security-Policy is present, not how strict it is.
Do I need to sign up?
No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
What does it cost?
The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
Does it attack my site?
No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
What doesn't it check?
Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.

Run the free scan