What it is
Every time a browser loads your page, your server sends back the page itself plus a short list of instructions the browser can't see displayed anywhere — these are called "headers". A few specific headers exist purely for security: they tell the browser things like "don't try to guess file types on your own" or "don't let another website embed my page inside an invisible frame". They don't change how your site looks at all — they're completely invisible to a visitor, working quietly in the background.
Why it matters
Without them, browsers fall back to more permissive, decades-old default behavior that a small number of attacks specifically rely on — things like tricking a browser into running a file as something it isn't, or invisibly embedding your login page inside another site to steal information typed into it. Missing security headers won't necessarily break anything visible today, but they're one of the first things a security-conscious visitor, a potential business partner doing basic diligence, or an automated scanner will check — and "none of these are configured" reads as a site nobody has finished setting up yet.
How to fix it
- Identify how your site is hosted: a static host like Netlify, Vercel, or Cloudflare Pages; a traditional web host with cPanel; or your own server.
- On Netlify or Cloudflare Pages: add a plain text file named
_headersto your site's published folder with lines likeX-Content-Type-Options: nosniff— both platforms apply it automatically, no coding required. - On Vercel: add a
vercel.jsonfile with aheaderssection listing the same header names and values — Vercel's own documentation has a copy-pasteable example for this exact case. - On a traditional host or your own server, ask your host's support team (or search "[your host name] add security headers") — most have a short, specific answer for their control panel.
- At minimum, add
X-Content-Type-Options: nosniffandReferrer-Policy: strict-origin-when-cross-origin— these two are safe, simple, and appropriate for virtually any small site. - Re-run your Launch Readiness check afterward to confirm the headers are now detected.