Your client handoff checklist is missing the 10-minute security pass

If you ship websites for clients, here's a scenario worth five minutes of your time.

It's three weeks after handoff. The client's developer brother-in-law, or their new marketing hire, or — worse — a prospect of theirs, loads the site and runs one of the free header scanners. The result comes back red across the board. Nobody remembers the beautiful Lighthouse score you sent at delivery. The question the client asks is: "Was this site actually finished when we paid for it?"

Nothing is broken. Nothing got hacked. But the story is now "the agency shipped it incomplete," and you're doing unpaid reputation repair on a project that closed a month ago.

I've been running passive launch-readiness scans on newly shipped sites all summer — public response headers and homepage HTML only, the exact thing any scanner or security-conscious prospect sees on first load. The pattern is remarkably consistent, and it applies to client work just as much as indie launches.

The numbers

From a 100-site scan roundup I published in August:

Check	Missing	What it means
Content-Security-Policy	76/100	Nothing mitigating XSS / injected scripts
Permissions-Policy	78/100	Camera, mic, geolocation unrestricted by default
X-Frame-Options	67/100	Clickjacking — pages iframed anywhere
Referrer-Policy	63/100	Full URLs leak to every third-party request
X-Content-Type-Options	57/100	MIME-sniffing exposure
HSTS	37/100	First-visit downgrade still possible

20 of 100 shipped with all six missing. Only 13 were fully clean.

And it's not just indie makers. This week I checked the homepages of ten boutique web agencies — shops that sell exactly this kind of diligence. Seven of the ten send zero of the six baseline headers on their own sites. I'm not naming anyone; the point is that "the professionals handle this" is not a safe assumption. It's nobody's job, so it's no one's job.

Why your handoff process doesn't catch it

Your delivery checklist almost certainly covers: Lighthouse scores, responsive breakpoints, forms, analytics, SEO meta, SSL certificate installed. All client-visible, all demonstrable in a meeting.

Response headers are invisible in every one of those. Lighthouse doesn't score them. The browser renders fine without them. No test fails, no deploy breaks, no client complains — until the day someone scans the site, and then the conversation is about your competence, not about a config line.

That's the asymmetry that makes this a handoff problem and not a tech problem: the cost lands after you've been paid, on your reputation, and the fix was ten minutes.

The fix is config, not code

All six headers are one-liners at the host or CDN layer. Vercel, Netlify, Cloudflare, nginx — each has a documented snippet, and four of the six can be applied at the edge without even touching the deploy. I published the full copy-paste configs here: The 6 security headers your launch is probably missing — and the one-line fix for each.

Realistic effort for a typical marketing site or small web app:

• First site: ~30 minutes (read, apply, verify, tighten the CSP once).
• Every site after: ~10 minutes, because it becomes a template.

Add one line to your handoff checklist — "headers scanned, result attached" — and this whole category of awkward conversation disappears.

Turn it into a deliverable, not just a fix

Here's the part most freelancers miss: this is billable, and it's a differentiator.

Clients have been trained by every security vendor's marketing that "secure" is a thing they should worry about and pay for. When you hand over the site with a dated before/after verification report — headers scanned, findings fixed, re-scan clean — you've done three things at once:

1. Given the client something tangible to justify your invoice against cheaper quotes.
2. Pre-empted the "was this even finished?" phone call forever.
3. Created a natural maintenance conversation — headers drift on redeploys and CDN changes, so re-verification is a legitimate recurring line item.

A verification table looks like this (real data, from a site whose owner fixed everything after a flag):

Header	Before	After
HSTS	missing	max-age=63072000; includeSubDomains; preload
Content-Security-Policy	missing	default-src 'self'; base-uri 'self'; object-src 'none'; …
X-Frame-Options	missing	DENY
X-Content-Type-Options	missing	nosniff
Referrer-Policy	missing	strict-origin-when-cross-origin
Permissions-Policy	missing	camera=(), microphone=(), geolocation=(), …

Six fixed, zero regressed, verified by independent re-scan. That table, attached to your handoff doc, is worth more than another page of prose about your process.

If you want it done for you

I run this as a fixed-scope service at Automata HQ:

• Launch-Ready Quick Scan — $12: self-serve baseline — headers, TLS basics, mixed content, exposed files. Run it on every client site the week before handoff.
• Launch-Ready Audit — $19: full human-reviewed report on one site, prioritized findings with the exact fix per platform, 48h turnaround.
• Deep Dive Audit — $99: agency-facing, white-labelable: audit + two retests + a dated "Launch Verified" certificate you can hand the client at go-live. Volume pricing if you're shipping 3+ sites a month.

Or take the checklist above, do it yourself, and charge your client for it — honestly, that's the outcome I'd pick for you. Ten minutes of config, one new line on your handoff doc, and one less way for a finished project to come back as a reputation problem.

Either way: scan the site before the client's brother-in-law does.