Does Netlify add security headers?

Netlify does not add security headers automatically. You must configure them manually through a _headers file or netlify.toml configuration. Without explicit configuration, your Netlify site will be missing Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, and Referrer-Policy headers. These missing headers leave your site vulnerable to XSS attacks, clickjacking, and MIME-type sniffing. Many developers deploying to Netlify skip this step entirely. UNPWNED scans your Netlify deployment and reports exactly which security headers are missing with ready-to-use configuration snippets.