When you ship an app with Cursor, Lovable or v0, the server replies with a set of HTTP headers: invisible instructions the browser obeys before rendering anything. Five of them decide a big chunk of your site security, and almost no template ships with them turned on.
Content-Security-Policy (CSP)
This is the queen. It tells the browser which domains may load scripts, styles or images. If an attacker manages to inject a malicious <script>, a solid CSP stops it from running. Start strict and open only what you need: default-src 'self' is an honest baseline. The classic mistake is leaving unsafe-inline, which throws away half the protection.
Strict-Transport-Security (HSTS)
It forces the browser to always use HTTPS for a period, even if the user types http://. This blocks someone on the same network from downgrading your connection. A reasonable value is max-age=31536000; includeSubDomains. Only enable it once you are sure your whole domain runs on HTTPS.
X-Frame-Options
It stops your site from loading inside another page's <iframe>. Without it, someone can embed your app in a fake site and trick users into clicking where they should not (clickjacking). DENY or SAMEORIGIN fixes it. Its modern form lives inside CSP as frame-ancestors.
X-Content-Type-Options
One value: nosniff. It stops the browser from guessing a file type and executing as a script something you served as text or an image. It is one line, there is no excuse to skip it.
Referrer-Policy
It controls how much of the origin URL is sent when navigating elsewhere. Without control, you can leak private paths or tokens that travel in the URL. strict-origin-when-cross-origin is a sensible balance between privacy and analytics.
Check yours with Scanaris
These headers are public information: anyone can read them, including you. Scanaris runs a read-only check of all five (and around 45 other things) in about 30 seconds, and for each missing one it hands you a fix prompt ready to paste into your AI. It exploits nothing and never touches your server: it only reads and tells you what to turn on. Scan your site and settle the doubt without being an expert.