Security Headers Generator
Choose HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and COOP, and get the config for Nginx, Apache, Caddy, Laravel or Express.
Free · No sign-up · Your inputs stay in your browser
Input
Generate HTTP security headers
Output
Configuration
7 headers
In Nginx, add_header in a location block replaces every add_header inherited from server, so a location with its own header silently drops all of these; repeat them or use an include. always also sends them on 4xx and 5xx responses. X-XSS-Protection is deliberately absent: modern browsers ignore it.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The baseline
Strict-Transport-Security makes browsers use HTTPS for your host from then on. X-Content-Type-Options: nosniff stops content-type guessing. A Content-Security-Policy or X-Frame-Options blocks clickjacking. Referrer-Policy limits what leaks in the Referer header, and Permissions-Policy switches off browser features you do not use. The OWASP Secure Headers Project keeps current recommendations.
The Nginx inheritance trap
Nginx's add_header directives are inherited from the server block only if the location block defines none of its own. Add a single header inside a location and every security header from the server block disappears for that location. Put them in a file and include it in each place, and add always so error responses carry them too.
HSTS preload
Preloading puts your domain in browsers' built-in HTTPS list. Removal takes months to reach users, so enable it only when every subdomain serves HTTPS for good.
