how to fix missing security headers
The safest workflow is simple: confirm what is missing in the live response, add the header in the correct delivery layer, then verify again after deployment.
Fix in this order
- Use the checker against the live response, not just local config files.
- Add the missing header where it is actually emitted: CDN, proxy, app config, or edge layer.
- Clear or wait out caches if the platform serves stale headers.
- Run the check again after deployment.
Next step
Open the checker first, then use the generator or platform guide to place the header in the layer that actually serves production traffic.