HTTPS and security headers in plain English

Your site loads with a padlock. Good start. HTTPS and security headers do different jobs—and many sites have one without the other.

HTTPS (TLS)

What it does: Encrypts traffic between the browser and your server so passwords and cookies aren't sent in plain text.

Common failures:

• Certificate expired or wrong domain name
• HTTP version still accessible without redirecting to HTTPS
• Mixed content (HTTPS page loading HTTP images or scripts)

Fix path: Renew certs (Let's Encrypt is free), force HTTPS at your host or CDN, fix mixed content URLs.

HSTS (Strict-Transport-Security)

What it does: Tells browsers "always use HTTPS for this domain for the next X days."

Why it matters: Stops sslstrip-style attacks on first visit after you already have HTTPS.

Fix path: Add the header at your reverse proxy, CDN, or framework config.

Content-Security-Policy (CSP)

What it does: Limits which scripts, styles, and images can run on your pages.

Why it matters: Reduces XSS damage when someone injects a malicious script.

Fix path: Start with report-only mode, tighten gradually—many vibe-coded apps need nonce or hash adjustments for inline scripts.

X-Frame-Options / frame-ancestors

What it does: Stops other sites embedding yours in an iframe (clickjacking).

Fix path: Set X-Frame-Options: DENY or CSP frame-ancestors 'self'.

X-Content-Type-Options

What it does: Prevents browsers from MIME-sniffing files into executable content.

Fix path: X-Content-Type-Options: nosniff—one line, easy win.

How VibeScan helps

We don't just say "header missing." We explain why you should care and what to do next— tuned for founders, not security engineers skimming a Qualys export.

Run a scan, open HTTP & Headers, and treat missing headers as a checklist—not a grade school report card.