title: How to add HTTP security headers to Next.js app
body: <p>I am completely new in web development and I'm trying to add HTTP security headers to my Next.js app but if I check it in securityheader.com it doesn't seem to work. </p>
  
  <pre><code>const express = require("express");
  const next = require("next");
  const helmet = require("helmet");
  
  const dev = process.env.NODE_ENV !== "production";
  const app = next({ dev });
  const handle = app.getRequestHandler();
  
  app
    .prepare()
    .then(() =&gt; {
      const server = express();
      server.use(helmet());
      server.use(helmet.xframe());
      server.use(helmet.hsts());
  
      server.get("*", (req, res) =&gt; {
        return handle(req, res);
      });
  
      server.listen(3000, err =&gt; {
        if (err) throw err;
        console.log("&gt; Ready on http://localhost:3000");
      });
    })
    .catch(ex =&gt; {
      console.error(ex.stack);
      process.exit(1);
    });
  </code></pre>
  
  <p>I'm looking for information for 4 days already and I still didn't find any example how to do it and I can't figure it out what exactly I'm doing wrong.</p>