HTTP security headers: the free layer almost nobody configures right
CSP, HSTS, X-Content-Type-Options — not decoration. Practical configuration for Next.js sites and APIs in production.
OWASP Secure Headers Project lists controls that reduce XSS, clickjacking, and downgrade attacks without rewriting your app. Smashing Magazine and CSS-Tricks have shown examples in modern frameworks; still scans of SMB sites in PR show missing headers or CSP with unsafe-inline for convenience.
Minimum viable: Strict-Transport-Security with preload consi
Minimum viable: Strict-Transport-Security with preload considered only if entire domain is HTTPS, X-Content-Type-Options nosniff, X-Frame-Options DENY or CSP frame-ancestors, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy restricting camera/microphone/geolocation where unused.
CSP requires thought: list allowed scripts, use nonces in Next
CSP requires thought: list allowed scripts, use nonces in Next.js for legitimate inline, avoid unsafe-eval. Report-uri or report-to internal endpoint helps iterate without breaking prod — starting in Report-Only is valid.
For pure JSON APIs, different but equally critical headers: do not cache auth responses, restrictive CORS (not * with credentials), and consider Cross-Origin-Resource-Policy. Google Security Blog has documented attacks cheaply mitigated by correct headers.
Verify with securityheaders.com and Mozilla Observatory after major deploys. Five minutes in next.config or middleware — hours saved in post-pentest remediation.
Operations and execution — connecting strategy with what the team ships every week.
