← Back to Guides

    How to Secure Netlify

    Step-by-step guide to securing your Netlify deployment and protecting your applications.

    Netlify Security Context

    Netlify provides automatic HTTPS and DDoS protection. Key security areas include the _headers file, Functions security, form handling, and deploy preview access control.

    Security Checklist

    1

    Configure environment variables

    Critical

    Store secrets in Netlify environment variables. Set different values for deploy contexts.

    2

    Set up _headers file

    Critical

    Configure security headers in _headers file for CSP, X-Frame-Options, etc.

    3

    Secure deploy previews

    Critical

    Restrict deploy preview access or enable password protection.

    4

    Review Netlify Functions

    Critical

    Audit serverless functions for security vulnerabilities and proper auth.

    5

    Secure form handling

    If using Netlify Forms, validate submissions and enable spam protection.

    6

    Configure redirects securely

    Audit _redirects file for open redirect vulnerabilities.

    7

    Enable HTTPS

    Verify HTTPS is enabled and force HTTPS redirects.

    8

    Review build settings

    Ensure sensitive data isn't exposed in build logs.

    9

    Set up team permissions

    Configure appropriate access for team members.

    10

    Enable audit logging

    Track deployments and changes.

    11

    Review Edge Functions

    Audit Edge Functions for security issues.

    12

    Configure Identity

    If using Netlify Identity, configure securely.

    13

    Review Large Media

    Ensure media files don't expose sensitive data.

    14

    Enable DDoS protection

    Verify DDoS protection is active.

    15

    Review split testing

    Ensure A/B tests don't expose sensitive variations.

    16

    Configure CORS

    Set appropriate CORS headers for functions.

    17

    Run security scan

    Use VibeEval to scan your deployed application.

    Related Resources

    Is Netlify Safe?

    In-depth security analysis.

    Netlify Checklist

    Interactive security checklist.

    Automate Your Security Checks

    Let VibeEval scan your Netlify application for vulnerabilities.

    Scan Your App