HTTP security headers are response headers that instruct the browser to enforce protections on your site: Content-Security-Policy limits what scripts can run, Strict-Transport-Security forces HTTPS, and X-Frame-Options stops your site being embedded for clickjacking. They are a cheap, high-value defense layer that most AI-generated apps ship without.
The ones that matter most
Content-Security-Policy is the strongest defense against cross-site scripting because it restricts which scripts the browser will execute. Strict-Transport-Security prevents downgrade to insecure HTTP. X-Frame-Options (or a frame-ancestors CSP directive) blocks clickjacking by stopping other sites from framing yours.
How to add them
Set them once at your framework or host level: a headers configuration in Next.js, middleware in Express, or your CDN's response-header settings. They apply to every response, so it is a one-time setup with broad payoff.
What this means for AI-generated code
Generated apps almost never include security headers, because nothing in a prompt asks for them and the app works fine without them. That leaves easy, well-understood attacks like cross-site scripting and clickjacking wide open on an otherwise functional app.