Security headers and updates
Add a safe set of security headers in next.config.ts and check they arrive in the browser, understand what a Content-Security-Policy is (and why it's an advanced, optional step), check your packages with npm audit, and switch on Dependabot so GitHub tells you when an update is needed and prepares it for you.
Why this matters
So far you've locked doors: forms, logins, the database. This lesson is about the walls: two kinds of protection that don't belong to any one page but cover the whole site.
Security headers are short instructions your site sends to every visitor's browser along with each page, like "never show this site inside another site's frame" or "don't guess what kind of file this is". Browsers have powerful protections built in, but some are only switched on when the site asks. Asking costs you a few lines of configuration.
Updates are the other wall. Your site is built from hundreds of packages written by other people. Every few weeks, someone finds a security hole in one of them, and a fixed version comes out. A site that's never updated keeps every hole it was born with. Bots scan for exactly those.
Neither job is exciting. Both are things a client will never see and always benefit from. And keeping packages updated is the heart of the monthly maintenance plan you'll sell in Module 14, so learning the routine now is learning a paid service.
In the full lesson
- The idea in plain English
- Do it
- Check it worked
- Understand what AI wrote
- Quick check
- What you can do now
The step-by-step, the prompt to copy, the video and the check-it-worked list, for every lesson in all 15 modules. GHS 399 ($40), paid once by mobile money or card, yours to keep.