How to Deploy to Netlify Securely

Before deploying to Netlify production, verify your security headers are in place, secrets are properly configured, deploy previews are protected, and Netlify Functions are secured.

Scan Your App Now

Find security issues automatically before attackers do.

Follow These Steps

Verify _headers file is in the publish directory

Ensure your security headers file will be deployed correctly.

Code Example

# Check if _headers exists in publish directory
ls -la public/_headers 2>/dev/null || ls -la dist/_headers 2>/dev/null || ls -la build/_headers 2>/dev/null

Verify no secrets are in netlify.toml

Check that no API keys or passwords are in the committed config file.

Code Example

grep -i "key\|secret\|password\|token" netlify.toml

Configure deploy preview protection

Set different environment variables for deploy previews.

Use test/sandbox API keys for deploy preview environments.

Secure all Netlify Functions

Verify every function has authentication checks and input validation.

Deploy and scan

Deploy to a branch deploy first, scan with VAS, then deploy to production.

What You'll Achieve

Your Netlify deployment has security headers, protected environment variables, secured functions, and has been verified by a security scan.

Common Mistakes to Avoid

Mistake

Placing _headers in the wrong directory

Fix

The _headers file must be in the publish directory (build/, dist/, or public/). Check your build output.

Mistake

Committing secrets to netlify.toml

Fix

Use the Netlify dashboard for environment variables, not netlify.toml. The TOML file is in git and visible to all collaborators.

Frequently Asked Questions

Does Netlify provide HTTPS automatically?

Yes. Netlify provides free automatic HTTPS with Let's Encrypt for all sites, including custom domains.

Ready to Secure Your App?

VAS automatically scans your deployed app for the security issues covered in this guide. Get actionable results in minutes.

Start Security Scan