Security on Netlify: what to check
Netlify hosts static front ends and serverless functions, and many apps built with AI tools are published there. HTTPS and certificates are handled for you.
Response headers come from a _headers file or netlify.toml in your project, so an app without one sends very few.
What to check on Netlify
-
Are your security headers set?
Add a _headers file to your publish folder, for example public/_headers in a Vite app, under the path "/*".
-
Are secret API keys exposed in your front end?
Keep keys in a Netlify Function, read from an environment variable set in the Netlify dashboard.
-
Is your site publishing its source maps?
Static builds can publish their source maps unless the build tool is told not to.
-
Can someone send email as your domain?
Your own domain's SPF and DMARC records are set at your DNS provider.
Where settings go on Netlify
- Security headers
- On Netlify, add it to a _headers file in your publish folder (for example public/_headers in a Vite app), under the path "/*".
- Secret keys
- Keep the key in a Netlify Function and read it from an environment variable set in the Netlify dashboard, without a VITE_ or NEXT_PUBLIC_ prefix.
Common questions
Where do security headers go on Netlify?
In a _headers file in the folder Netlify publishes, or in netlify.toml.
Are Netlify environment variables public?
They are private in the dashboard, but any that your build tool puts into the front end, such as VITE_ variables, become public.