Netlify Security Posture

A platform for building and deploying web applications.

Netlify Security Overview

Netlify provides automated HTTPS, but custom security headers require explicit configuration via a netlify.toml file or a _headers file in the publish directory.

Security Checks

HTTPS (pass)

Certificates are automatically provisioned and traffic is served over TLS.

Security Headers (warn)

Requires manual configuration of _headers or netlify.toml to enforce HSTS and CSP.

Branch Deploys (warn)

Branch and deploy previews are public by default unless site-wide password protection is configured.

Run a Security Audit

These technical checks are informational heuristics, not a guarantee of security or compliance. Passing a scan does not guarantee protection against zero-days or application logic flaws. Always conduct independent professional audits.