HttpFixer → Tools → Pre-Launch Checklist

Pre-Launch HTTP Security Checklist

Check off every item before deploying. Each item links directly to the fixing tool. Progress saves in your browser.

Score: 0 / 0 items

✓ All checks passed. Your site is ready to deploy.

Security Headers

Strict-Transport-Security set

max-age ≥ 31536000, includeSubDomains. Prevents HTTPS downgrade attacks.

Fix →

Content-Security-Policy set

At minimum: default-src 'self'; frame-ancestors 'none'; object-src 'none'.

Fix →

X-Frame-Options: SAMEORIGIN

Prevents clickjacking. Backup to CSP frame-ancestors for older browsers.

Fix →

X-Content-Type-Options: nosniff

Prevents MIME-type sniffing that can enable XSS via crafted files.

Fix →

Referrer-Policy set

Recommended: strict-origin-when-cross-origin. Prevents referrer leaking.

Fix →

Permissions-Policy set

Disable unused browser APIs: camera=(), microphone=(), geolocation=().

Generate →

CORS & API

Access-Control-Allow-Origin not set to *

Wildcard is fine for fully public APIs. Never combine * with credentials: true.

Test →

OPTIONS preflight handler returns 204

All API endpoints that accept POST/PUT/DELETE with JSON need an OPTIONS handler.

Test →

Authenticated API responses have Cache-Control: no-store

Prevents CDNs from caching user-specific responses and serving to other users.

Audit →

HTTPS & Transport

HTTP redirects to HTTPS (301)

All HTTP requests should redirect permanently. Use 301, not 302.

Check →

No mixed content (no HTTP assets on HTTPS pages)

All images, scripts, fonts, and stylesheets loaded via HTTPS.

Fix →

TLS certificate valid and not expiring within 30 days

Check expiry date and ensure auto-renewal is configured.

Check →

Caching

Static assets have long cache (max-age=31536000, immutable)

JS, CSS, images with hashed filenames should cache for 1 year.

Visualise →

HTML pages use Cache-Control: no-cache

HTML should always be revalidated so users get updated asset URLs.

Audit →

Vary: Accept-Encoding on compressed responses

Without this, CDNs may serve compressed content to clients that don't support it.

Audit →

Final Checks

HeadersFixer scan on production URL passes

Run HeadersFixer on the live URL after deploying to confirm all headers are present.

Scan →

Header Diff shows staging ≈ production

No security headers should disappear when moving from staging to production CDN.

Compare →

Server header doesn't expose version (e.g. "nginx/1.24.0")

Use server_tokens off in Nginx. Hides exact version from attackers.

Scan →