# HTTP Headers

> How to configure HTTP headers for AI agents: security headers, AI discovery Link headers, and CORS for .well-known resources.

Questo controllo pesa il 4% del punteggio.

*Queste guide alla correzione sono scritte in inglese.*

<a id="missing-critical-header"></a>

## Missing critical security header

One or more critical security headers are missing from your HTTP response. ax-audit checks for 7 security headers, with these being critical:

- `Strict-Transport-Security`: enforces HTTPS
- `X-Content-Type-Options`: prevents MIME sniffing
- `X-Frame-Options`: prevents clickjacking

In Next.js, add headers in `next.config.js`:

```
// next.config.js
async headers() {
  return [{
    source: '/(.*)',
    headers: [
      { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
      { key: 'X-Content-Type-Options', value: 'nosniff' },
      { key: 'X-Frame-Options', value: 'DENY' },
      { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
      { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
    ],
  }];
}
```

For Vercel, use `vercel.json`. For Nginx/Apache, add the headers in your server configuration.

---

<a id="low-security-headers"></a>

## Low security header count

Fewer than 4 of the 7 checked security headers are present. Security headers are important not just for security but also for trust signals: AI agents can factor them into reliability assessments.

Add the missing headers from the list above. Use [securityheaders.com](https://securityheaders.com) to scan your site and see which headers are missing.

---

<a id="missing-agent-link"></a>

## Missing agent.json in Link header

Your Link header references llms.txt but not agent.json. Add it:

```
Link: </llms.txt>; rel="alternate"; type="text/plain",
      </.well-known/agent.json>; rel="alternate"; type="application/json"
```

---

<a id="missing-llms-link"></a>

## Missing llms.txt in Link header

Your Link header references agent.json but not llms.txt. Add it alongside your existing Link header entries.

---

<a id="no-ai-discovery"></a>

## Link header without AI discovery

Your site sends a Link header but it doesn't include references to AI discovery files. Add entries for both llms.txt and agent.json to your existing Link header.

---

<a id="no-link-header"></a>

## No Link header

Your site doesn't send any Link response header. The Link header allows AI agents to discover your AX files without parsing HTML:

```
// next.config.js
async headers() {
  return [{
    source: '/(.*)',
    headers: [
      {
        key: 'Link',
        value: '</llms.txt>; rel="alternate"; type="text/plain", </.well-known/agent.json>; rel="alternate"; type="application/json"'
      },
    ],
  }];
}
```

---

<a id="no-cors"></a>

## No CORS on .well-known

Your `/.well-known/agent.json` endpoint doesn't include CORS headers. Browser-based AI agents need `Access-Control-Allow-Origin: *` to fetch your discovery files cross-origin.

```
// next.config.js
async headers() {
  return [{
    source: '/.well-known/:path*',
    headers: [
      { key: 'Access-Control-Allow-Origin', value: '*' },
      { key: 'Access-Control-Allow-Methods', value: 'GET, OPTIONS' },
    ],
  }];
}
```

---

<a id="discovery-relations"></a>

## No discovery relations advertised

Your responses carry no `Link` relations beyond llms.txt and the Agent Card, so everything else you publish has to be found by guessing paths. Some of it never will be: a `Link` header is the only way to point at a resource that lives somewhere unguessable.

The relations this check looks for:

- `describedby`: the llms.txt covering this page (llms.txt v2)
- `api-catalog`: the catalog of APIs you offer (RFC 9727)
- `service-desc`: a machine-readable API description (RFC 8631)
- `service-doc`: human documentation for that API (RFC 8631)
- `ai-catalog`: the file listing your agent cards and MCP server cards
- `c2pa-manifest`: content provenance for media on the page (C2PA 2.4)
- `license`: machine-readable licensing terms, RSL among them
- `alternate` with `type="text/markdown"`: the cheap representation of this page

```
Link: </llms.txt>; rel="describedby",
      </.well-known/api-catalog>; rel="api-catalog",
      </.well-known/ai-catalog.json>; rel="ai-catalog",
      </index.md>; rel="alternate"; type="text/markdown"
```

Advertise only what you actually publish: a relation pointing at a 404 is worse than none. Nothing here affects your score; it is reported because these are the relations that stop an agent guessing.

> **Watch for a framework overwriting the header**
>
> Link
>
>  is a single header that several things like to own: internationalisation middleware emitting
>
>
>
> alternate
>
>  hreflangs, asset preloading, CDN features. If yours sets the header rather than appending to it, the relations you configured never ship, and nothing warns you.

---

Rappresentazione Markdown di https://axrush.com/guides/http-headers