# Ensure static sites set security response headers

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876665247669-ensure-static-sites-set-security-response-headers
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each static site sets security response headers on all paths (/\*), including Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options, using Render's custom response headers.

**Rationale**

Security headers tell browsers to use HTTPS only, block the site from being framed by other sites, stop content type guessing, and limit which scripts can run. Without them, visitors are more exposed to clickjacking, content injection, and protocol downgrade attacks.

**Impact**

-   Visitors are protected from clickjacking and content injection
    
-   Browsers are told to always use HTTPS
    
-   A strict Content-Security-Policy may need tuning so the site still works
    

**Default Value**

By default, Render does not add these custom security headers to static sites.

**Pre-Requisites**

-   Admin or Developer role on the static site
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the static site's Headers page from the left pane and review the header rules for the /\* path (which matches all request paths).
    
4.  Alternatively, run: curl -I https://<your-site> and check the response headers.
    
5.  If any of the four headers is missing, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the static site's Headers page from the left pane and add rules for the path /\* with these headers (each rule has a path, a name, and a value): Strict-Transport-Security (for example max-age=31536000; includeSubDomains), Content-Security-Policy (for example default-src 'self'), X-Frame-Options (DENY or SAMEORIGIN), and X-Content-Type-Options (nosniff).
    
4.  Save the changes and test the site to confirm it still works.
    
5.  If the site is managed by a Blueprint, add the same rules under headers in render.yaml.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the Headers page and remove or edit the header rules.
    

**Reference**

-   [https://render.com/docs/static-site-headers](https://render.com/docs/static-site-headers)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.