This week I did something I've been meaning to do for a while: I took 10 products that launched in the last 48 hours — a mix of Product Hunt launches and "I built this" posts on Reddit — and ran a passive launch-readiness check on each one.
Passive means exactly that: public HTTP response headers and homepage HTML only. No probing, no auth attempts, nothing intrusive — the same thing any scanner, prospect, or security-conscious customer sees when they load your site once.
I'm not naming anyone. The point isn't to call out individual makers — it's that the failures were so consistent they form a pattern worth publishing.
The results
7 out of 10 shipped with no Content-Security-Policy header at all.
3 out of 10 were missing Strict-Transport-Security — including one product ranked #1 on Product Hunt the day it launched.
Across the 10 sites, the most common gaps, in order:
| Check | Failed | Why it matters |
|---|---|---|
| Content-Security-Policy | 7/10 | Nothing mitigating XSS / injected scripts |
| Referrer-Policy | 6/10 | Full URLs leak to every third-party request |
| Permissions-Policy | 6/10 | Camera/geo/mic features unrestricted by default |
| X-Frame-Options | 6/10 | Site can be framed anywhere → clickjacking |
| X-Content-Type-Options | 6/10 | MIME-sniffing exposure on user content |
| HSTS | 3/10 | First-visit downgrade possible |
Two products were genuinely clean — all six headers present, HSTS with preload. Both were small solo projects, which killed my assumption that "bigger launch = better hygiene."
Why this keeps happening
None of these are code fixes. Every one is a one-line config change at the host or CDN layer — Vercel, Netlify, Cloudflare, nginx, all of them have a documented snippet for it. The failure mode isn't skill, it's that launch week has a hundred things in it and "headers" is item #101. There's no test that fails, no deploy that breaks, no user who complains. The site just quietly tells every visitor's browser "no rules, do whatever."
That's exactly the class of problem that only gets caught by something that checks, every time, automatically — because humans are bad at "every time."
The SEO side wasn't much better
While I was in the HTML I checked the basics too:
- 2/10 homepages had no
<h1>— your single best keyword slot, empty - Meta descriptions over 200 chars (truncates at ~160 in search results) on half of them
- One product had a meta description of 2,701 characters
- Missing
alttext on the majority of images on 8/10 sites
Again: not skill. Just nobody checked.
What I'd do differently (and did)
I run these checks on every launch now, including my own. My rule is simple: a launch isn't done when the deploy succeeds — it's done when the thing a stranger's browser receives passes a baseline.
If you shipped something recently and want to know where you stand: I run a Launch-Ready Quick Scan — passive headers/TLS/HTML checks plus a human-written readout of what to fix first, delivered within 24h. It's $29 for the launch period (normally $49), and the report is written so you can hand it straight to whoever owns your deploy config. Grab one here.
And if you're pre-launch: the six headers above are a 20-minute fix tonight. Do it before the traffic, not after.
Top comments (2)
Appreciate that — and the pattern keeps holding: I've now run the same passive check on ~70 launches across a few communities, and CSP is still missing on roughly 7 out of 10. Stack doesn't matter either — Vercel, Netlify, Cloudflare, bare nginx all fail it at about the same rate, which says it's a launch-checklist problem, not a tooling one.
Your thread is still the one I'm watching for a happy ending though. Once your headers land I'm genuinely curious whether the re-scan surfaces anything else — the offer stands whenever you're ready. Cheers back 🍻
Read your "10 products, 7 failed" piece after our exchange on my post, funny to see the same one-line CSP/HSTS gap show up that often. Good methodology, and yeah, the passive-scan approach is a reasonable way to spot these before they become someone's incident. Cheers 🍻.