GLC-CSP-MISSING · GLC-FRAME-MISSING · 17 October 2026
These are two findings, not one. GLC-CSP-MISSING is a missing policy. GLC-FRAME-MISSING is missing frame protection. A header block can have either, both, or neither.
GLC-CSP-MISSING (high). Content-Security-Policy is missing or blank, so the browser will not block an injected script. Content-Security-Policy-Report-Only does not count. Any non-blank policy clears this finding, including a weak one. This check does not score the policy.
GLC-FRAME-MISSING (medium). The block has neither an X-Frame-Options whose first token is DENY or SAMEORIGIN, nor a Content-Security-Policy frame-ancestors list other than a lone *. Another site can frame the page. A report-only policy does not supply frame-ancestors for this check.
Checked on this API on 17 October 2026. The same block with the other three headers present, plus Content-Security-Policy-Report-Only and X-Frame-Options: DENY, returned only GLC-CSP-MISSING. frame-ancestors * with X-Frame-Options: ALLOWALL returned GLC-FRAME-MISSING. A policy of default-src 'self'; frame-ancestors 'none' returned no findings. default-src 'self' alone left GLC-FRAME-MISSING. X-Frame-Options: DENY alone left GLC-CSP-MISSING.
Collect the headers on a deployment you already operate. This server does not open that URL, and it does not guess the platform from the Server header. POST the text to https://dontdeployonfriday.com/v1/analyze. The body is at most 64 KB. Name platform as caddy, nginx, vercel, netlify, or nextjs if you want a snippet. Any other name, or no platform, returns fix: null.
curl -sS https://dontdeployonfriday.com/v1/analyze \
-H 'content-type: application/json' \
--data '{"headers_raw":"HTTP/1.1 200 OK\nStrict-Transport-Security: max-age=31536000\nX-Content-Type-Options: nosniff\nReferrer-Policy: no-referrer\n","platform":"caddy"}'
That block has HSTS, nosniff, and a referrer policy, and it has no CSP and no frame control. On 17 October 2026 the JSON findings were GLC-CSP-MISSING and GLC-FRAME-MISSING, each with a Caddy snippet. The same call with the platform omitted returns the same two ids and fix: null.
Prefer that HTTPS URL. The name on port 80 redirects to HTTPS. The bare IP still answers on port 80 without TLS. Do not POST secrets, cookies, or tokens on either URL. Leave Cookie, Authorization, and Set-Cookie out of the header block.
Thirty requests per minute per IP, then 429. The response sends Cache-Control: no-store. An empty findings list means those seven header checks were clear in the text you sent. It is not a certificate and it is not a pentest. The home page lists the other five ids. Markdown has the same note.
These are the GLC-CSP-MISSING snippets from the local registry, last_verified 2026-10-17. The source URL is a citation. This server does not fetch it. Each starter sets frame-ancestors 'none', so pasting it also clears GLC-FRAME-MISSING once that header is what the deployment sends. Read the snippet before you paste it. It blocks inline scripts. Add the hosts the app actually loads. A starter can break an app that needs a looser policy.
Source: caddyfile header. Checked 2026-10-17.
# Add the hosts this app actually loads. This starter blocks inline scripts. header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'"
Source: ngx_http_headers_module add_header. Checked 2026-10-17. nginx is not installed on this host, so this line was not passed to nginx -t.
# Add the hosts this app actually loads. This starter blocks inline scripts. # Keep this with your other add_header lines. A nested block that sets add_header drops headers inherited from above. add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'" always;
Source: vercel.json headers. Checked 2026-10-17. The JSON file carries the note outside the snippet: add the hosts this app actually loads. This starter blocks inline scripts.
{
"headers": [
{
"source": "/(.*)",
"headers": [
{
"key": "Content-Security-Policy",
"value": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'"
}
]
}
]
}
Source: Netlify custom headers. Checked 2026-10-17.
# Add the hosts this app actually loads. This starter blocks inline scripts. Applies to files Netlify serves. A function or a proxy must set this header itself. /* Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'
Source: headers() in next.config.js. Checked 2026-10-17.
// Add the hosts this app actually loads. This starter blocks inline scripts.
module.exports = {
headers() {
return [
{
source: '/:path*',
headers: [
{
key: "Content-Security-Policy",
value: "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'",
},
],
},
];
},
};
Use these GLC-FRAME-MISSING snippets when the deployment already sends a Content-Security-Policy and that policy does not set frame-ancestors to something other than *. X-Frame-Options: DENY clears the frame finding and does not clear GLC-CSP-MISSING. Same registry date, 2026-10-17. Do not fetch the source URL from this server. The caller does that, if at all.
Source: caddyfile header.
header X-Frame-Options DENY
Source: ngx_http_headers_module add_header. Not passed to nginx -t on this host.
# Keep this with your other add_header lines. A nested block that sets add_header drops headers inherited from above. add_header X-Frame-Options "DENY" always;
Source: vercel.json headers.
{
"headers": [
{
"source": "/(.*)",
"headers": [
{
"key": "X-Frame-Options",
"value": "DENY"
}
]
}
]
}
Source: Netlify custom headers.
# Applies to files Netlify serves. A function or a proxy must set this header itself. /* X-Frame-Options: DENY
Source: headers() in next.config.js.
module.exports = {
headers() {
return [
{
source: '/:path*',
headers: [
{
key: "X-Frame-Options",
value: "DENY",
},
],
},
];
},
};
DENY is the right frame policy for an app that must be embedded by a parent you chose. SAMEORIGIN also clears the finding. A frame-ancestors list other than a lone * does too.