Cursor writes great TypeScript — and still forgets canonical tags, security headers and structured data.

Why Cursor apps fail SEO out of the box

Cursor typically scaffolds Next.js App Router with reasonable defaults, but the SEO/Security layer is easy to skip. The framework gives you the hooks (metadata export, headers(), middleware) — most Cursor sessions never reach them because the agent stops once the feature works. That leaves canonical tags missing, CSP unset, sitemap.ts absent, and the X-Powered-By header still leaking the framework version.

The 7 Next.js things Cursor forgets — and how to patch them in one diff

1. 1

   next.config.ts ships without security headers

   Critical

   Cursor almost never adds the async headers() block to next.config.ts. That means no CSP, no HSTS, no X-Frame-Options, no nosniff. A 5-line function fixes all five. Pantra emits the exact function body.

   Copy-paste fix prompt →
2. 2

   Missing openGraph metadata

   High

   Shareable links look like hot garbage without og:title, og:description and og:image. Next.js makes this trivial — metadata.openGraph in layout.tsx — but Cursor often stops at <title> and <meta description>.

   Copy-paste fix prompt →
3. 3

   No app/sitemap.ts

   High

   Next.js has first-class support for a typed sitemap (app/sitemap.ts returning MetadataRoute.Sitemap). Cursor rarely generates it. Pantra emits the exact file tailored to your routes.

   Copy-paste fix prompt →
4. 4

   Bundle creep — Core Web Vitals silently degrade

   Medium

   Every new Cursor session adds another client component, another library, another hook. The First Load JS climbs past 300kb and LCP/INP quietly fall below thresholds. Pantra pulls the live PageSpeed score and flags the specific regressions.

   Copy-paste fix prompt →
5. 5

   No opengraph-image.tsx

   Medium

   Next.js lets you generate dynamic OG images per route via app/opengraph-image.tsx and ImageResponse. Cursor almost never writes this file — every shared link gets Next.js' default placeholder or nothing at all.

   Copy-paste fix prompt →
6. 6

   No app/robots.ts (AI crawlers get no signal)

   Medium

   Same story as sitemap — Next.js has app/robots.ts built in. Missing means AI crawlers fall back to their defaults (mostly: do nothing useful). Add four Allow blocks for GPTBot, ClaudeBot, PerplexityBot, Google-Extended.

   Copy-paste fix prompt →
7. 7

   No JSON-LD structured data

   Medium

   Organization and WebSite schemas belong in the root layout.tsx. Article schema belongs in blog [slug] layouts. Cursor emits none of it out of the box.

   Copy-paste fix prompt →

Frequently asked questions