Versão em português

Security Headers Checklist Before Go-Live

Updated July 3, 2026 · XploreNetHub editorial guide

Before calling a site production-ready, validate HTTP security headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy. Run this checklist after DNS and SSL — missing headers do not break the site but increase risk.

This guide complements the DNS and SSL checklist. Use the Security Headers Validator to audit any URL.

Recommended order

  1. DNS Lookup — correct records
  2. WHOIS — active domain (if new)
  3. SSL Checker — valid HTTPS
  4. Security Headers — this checklist

Verification table

HeaderPresent (good)Missing (risk)
Strict-Transport-SecurityForces HTTPS on future visitsPossible downgrade on first connection
Content-Security-PolicyLimits script/style sourcesLarger XSS surface
X-Frame-OptionsReduces clickjackingPage may load in malicious iframe
X-Content-Type-Options: nosniffBlocks MIME sniffingBrowser may misinterpret type
Referrer-PolicyControls URL leakageFull referrers may expose paths
Permissions-PolicyRestricts browser APIsSensitive features unrestricted

Checklist steps

  1. Open the validator with your production URL (e.g. vercel.app).
  2. Note present headers — document values internally.
  3. For each missing header, decide if it blocks go-live (public API = yes; static landing = medium priority).
  4. Enable HSTS only with stable HTTPS — start with a short max-age when testing.
  5. Roll out CSP gradually (report-only first when possible).
  6. Re-run after deploying fixes.

Tool

Frequently asked questions

What are security headers?

HTTP instructions that harden how the browser handles your app.

Production minimum?

HSTS + X-Content-Type-Options + anti-framing (X-Frame-Options or CSP frame-ancestors).

Site works without them?

Yes, with weaker security posture.

When to validate?

After DNS and SSL in production, before announcing go-live.

What is HSTS?

Forces HTTPS; requires a valid certificate first.

Free validation?

Security Headers Validator on XploreNetHub.

More guides: DNS & SSL Checklist · Security Headers Checklist · DNS Glossary

Home | About | Contact