Next.js security headers checklist

Why do Next.js headers matter on production?

You probably set headers in next.config, middleware, or your host settings. Then production drifts. CDN defaults, platform overrides, and a rushed deploy can all change what browsers actually get.

Config files are intentions. Live responses are reality. Scan the deployed hostname.

What is on the Next.js security headers checklist?

1. HTTPS and HSTS enforced on the production domain.
2. Content-Security-Policy present and not dangerously loose where visible.
3. X-Frame-Options or frame-ancestors to cut clickjacking risk.
4. X-Content-Type-Options to block common MIME confusion.
5. Referrer-Policy so URLs do not leak more than they should.
6. Cookie flags like Secure, HttpOnly, and SameSite on live responses.

If any of these fail, fix production first. Arguing about local config can wait.

How do I verify headers without guessing?

Go to /lookup and scan the deployed hostname. Fix the highest-priority gaps, redeploy, then rescan from /lookup.

What does this checklist skip?

Dependency scanning, repo secret hunting, and authenticated route testing. Useful later. Wrong first pass for a team that has not checked public headers yet.