Why Security Headers Are Not Working

Headers can differ between http and https, www and non-www, root paths and app paths, or one locale route and another.

Use /redirect-checker to see the final URL, then scan that final response with /security-headers-checker.

CDNs, reverse proxies, and hosting platforms can add, replace, or remove headers after your app sends a response.

If a header exists locally but not in production, check the CDN rules and any edge middleware before assuming the app code is wrong.

Framework middleware can be route-specific. It may run for pages but not static assets, API routes, image routes, or error pages.

Check the route pattern and make sure the middleware covers the paths you care about.

A header on the first response does not always appear on the final response. Browsers care about the final page they load after redirects finish.

Long redirect chains also make debugging harder. Clean up the chain before judging whether headers are working.

Example one: your app sets HSTS, but users land on a CDN-hosted www URL that does not include it. The fix is to add the header at the CDN or canonical host.

Example two: CSP works on /dashboard but not /. The middleware may only match app routes, or a static hosting rule may be serving the homepage directly.