Next.js Security Headers Starter

July 25, 2026 ยท View on GitHub

A small, dependency-free baseline for adding and checking common security headers in a Next.js application.

What this includes

  • next.config.mjs: conservative global response headers
  • scripts/check-headers.mjs: dependency-free production header check
  • SECURITY.md: responsible disclosure template

This starter intentionally does not ship a copy-paste Content Security Policy. CSP must match the scripts, styles, images, analytics, payments, and third-party services used by the specific application; a generic policy can break production or create a false sense of protection.

Install the configuration

Install from npm (after publication)

npm install poszo-nextjs-security-headers

Then merge the exported array into your existing Next.js configuration:

import { securityHeaders } from "poszo-nextjs-security-headers";

export default {
  async headers() {
    return [{ source: "/:path*", headers: securityHeaders }];
  },
};

Until the first npm release is published, install directly from the public GitHub repository or use the copy-paste setup below.

Copy-paste setup

  1. Copy the securityHeaders array from index.mjs and the headers() function from next.config.mjs into your existing Next.js configuration.
  2. Merge rather than overwrite any existing headers() rules.
  3. Deploy to a preview environment.
  4. Verify the preview:
node scripts/check-headers.mjs https://your-preview.example.com
  1. Test authentication, checkout, embeds, uploads, analytics, and other critical paths before promoting to production.

Verify any deployed site

npx poszo-nextjs-security-headers https://example.com

The checker exits non-zero when a required header is missing or materially weaker than the included baseline.

What this does not promise

Headers are one security layer, not a complete audit. This repository does not test authorization, dependency vulnerabilities, secrets, data handling, business logic, or application-specific CSP correctness.

Need the full operator bundle?

Poszo's Website Rescue DIY Pack + Next.js Security Kit includes eight platform-agnostic repair worksheets, rollout/rollback guidance, verification recipes, and the expanded technical kit:

Maintained by Poszo LLC.

License

MIT. See LICENSE.

Listed on

Featured on Twelve Tools