Content-Security-Policy
Controls which script, style, frame, form, and connection sources the browser may use. Start with Report-Only when a strict policy could break an existing app.
Free security headers checker
See what your live app tells the browser.
Paste the public URL for your Lovable, Bolt, Replit, Cursor, or agent-built app. LaunchGlint checks the response for common browser protections and shows the top launch findings without signup.
CSP
HSTS
Frame policy
Nosniff
Referrer policy
What the header check means
Preview the deep reportStrict-Transport-Security
Tells browsers to use HTTPS for future requests. Enable it only after HTTPS and subdomain coverage are stable, because an incorrect long-lived policy can lock users out.
Frame embedding protection
Use CSP frame-ancestors or X-Frame-Options to prevent unwanted embedding and reduce clickjacking risk, unless your product intentionally supports embeds.
X-Content-Type-Options
nosniff tells browsers to respect declared content types instead of guessing, which matters especially for script, style, and user-uploaded responses.
Referrer-Policy
Controls how much of the current URL is sent to another site. A deliberate policy reduces accidental leakage of paths and query parameters.
Headers are one layer
Good headers do not verify authorization, database rules, business logic, dependency safety, or private source code. Treat this as launch QA, not proof of security.