Free Security Headers Checker for Next.js App Built with Cursor

Quick answer

A security headers checker scans your Next.js app for missing HTTP response headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options. For apps built with Cursor, use a free tool like OverMCP's security headers checker – just enter your URL and get an instant report. Then apply fixes in your next.config.js or vercel.json to harden your app in minutes.

What to check first

Before diving into configuration, run a quick scan to know where you stand. Here's a concrete checklist:

Step-by-step fix

Follow these actions to add security headers to your Next.js app built with Cursor. We'll use the next.config.js for header injection, which works for both App Router and Pages Router.

1. Scan your app

Go to OverMCP's security headers checker and enter your deployment URL (e.g., https://my-cursor-app.vercel.app). Note the missing headers.

2. Update `next.config.js`

Add the headers function inside your config. Here's a realistic snippet for a typical Cursor-built Next.js app:

// next.config.js
const nextConfig = {
  async headers() {
    return [
      {
        source: '/(.*)',
        headers: [
          {
            key: 'Content-Security-Policy',
            value: "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https://api.example.com; frame-ancestors 'none';",
          },
          {
            key: 'Strict-Transport-Security',
            value: 'max-age=31536000; includeSubDomains; preload',
          },
          {
            key: 'X-Frame-Options',
            value: 'DENY',
          },
          {
            key: 'X-Content-Type-Options',
            value: 'nosniff',
          },
          {
            key: 'Referrer-Policy',
            value: 'strict-origin-when-cross-origin',
          },
          {
            key: 'Permissions-Policy',
            value: 'camera=(), microphone=(), geolocation=()',
          },
        ],
      },
    ];
  },
};

module.exports = nextConfig;

Customize the CSP – if your Cursor-generated app uses external scripts (analytics, fonts, APIs), adjust the script-src, style-src, and connect-src accordingly. For development, you can temporarily allow 'unsafe-eval' but remove it in production.

3. Deploy and re-scan

Push your changes to Vercel (or your hosting). Then run the security headers checker again to confirm all headers are present.

4. For Vercel deployments, use `vercel.json` (optional)

If you prefer Vercel's config, add headers there:

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Content-Security-Policy",
          "value": "default-src 'self'"
        },
        {
          "key": "Strict-Transport-Security",
          "value": "max-age=31536000; includeSubDomains; preload"
        },
        {
          "key": "X-Frame-Options",
          "value": "DENY"
        }
      ]
    }
  ]
}

Common mistakes

Cursor-generated Next.js apps often miss security headers entirely. Here's what goes wrong:

Why OverMCP for Cursor-built apps

OverMCP is built for developers who ship fast with AI tools. Our free AI app security scanner checks more than just headers – it scans for leaked secrets, SSL issues, and OWASP Top 10 vulnerabilities. For continuous protection, set up continuous security monitoring to catch regressions after every deploy.

FAQ

Why does my Cursor-built Next.js app have no security headers?

Cursor's default templates don't include security headers. You must manually add them via next.config.js or vercel.json. Run a security headers checker to confirm.

How do I test security headers locally?

Use a browser's DevTools (Network tab) or run a curl command: curl -I http://localhost:3000. For a full check, deploy to a staging environment and use OverMCP's free scanner.

What is the most important security header for Next.js?

Content-Security-Policy (CSP) is critical because it prevents XSS attacks. For Cursor-built apps, start with a strict CSP and whitelist only needed sources.