HTTP Header Generator

Configure HTTP security, cache control, and CORS headers and generate web server config blocks.

Strict-Transport-Security (HSTS)

Force secure HTTPS connections

HSTS Directives

X-Frame-Options (XFO)

Prevent clickjacking by control framing

Frame Policy

X-Content-Type-Options

Prevent MIME-type sniffing (sets nosniff)

X-XSS-Protection

Enable legacy browser XSS filters

XSS Policy

Referrer-Policy

Control amount of referrer info sent with requests

Referrer Policy

Content-Security-Policy (CSP)

Restrict dynamic script, styling, and media resources

CSP Directive Value

Permissions-Policy

Allow or deny browser features and APIs

Configuration Code6 headers active

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';

Why use HTTP security headers?

HTTP security headers are a fast, zero-cost hardening layer: they are set server-side and tell browsers how to handle your content. HSTS forces HTTPS upgrades for a full year. CSP restricts which origins can load scripts, styles, and media — the most effective XSS mitigation available. X-Frame-Options stops your pages from being embedded in malicious iframes (clickjacking). Referrer-Policy limits how much URL info leaks when users follow outbound links. These headers are checked by tools like securityheaders.com and affect Google's Safe Browsingand Chrome's warning interstitials.

Related tools: URL Encoder · Robots.txt Generator · Sitemap XML Generator

Built and maintained by Meet Shah · Last updated 1 August 2026

What this tool is used for

Producing a set of security headers for a site that has none.
Getting an HSTS or a frame-options value right without looking it up.
Producing Nginx and Apache snippets for the same header set.
Comparing a generated set against what a site currently sends.
Building a header set to trial before enforcing it.

Frequently Asked Questions

What does the default HSTS value do?: `max-age=31536000; includeSubDomains; preload` tells browsers to use HTTPS for a year, extends that to every subdomain, and signals intent to join the preload list. Only set `includeSubDomains` once every subdomain really does serve HTTPS.
Why does the default CSP allow unsafe-inline?: Because a policy that breaks the site gets removed entirely, and a starting policy that loads is more useful than a perfect one that does not. Inline script is the weakest part of it — move to nonces or hashes and drop `unsafe-inline` as soon as you can.
Is X-XSS-Protection still worth setting?: Barely. The auditor it controlled has been removed from Chrome and Edge and was never in Firefox, and its filtering introduced vulnerabilities of its own. It is included here because scanners still flag its absence; a real CSP is the actual defence.
What does the Permissions-Policy toggle emit?: An explicit allow-list per feature — `camera=self` when enabled, `camera=()` when not. Writing the empty list is the point: it denies the feature to your own page and every embedded frame, whereas omitting the directive leaves the default in place.
Can I use Allow-Origin: * with credentials?: No, and browsers enforce this. `Access-Control-Allow-Credentials: true` requires a single specific origin to be echoed back — the wildcard is rejected outright. Echo the request's Origin after checking it against your own list.
Where do these headers actually go?: On the server or edge — an nginx `add_header` block, an Apache `Header set`, or your CDN's rules. Setting them in a `<meta>` tag works only for a subset of CSP and not at all for the rest.

Common errors and gotchas

Setting HSTS with a long max-age and preload before HTTPS is fully working, which is very hard to undo.
Enforcing a CSP without a report-only trial, which breaks the page for everyone at once.
Setting a permissive CORS origin in production, which exposes an authenticated API to any page.
Adding headers at the CDN and the origin with conflicting values.
Assuming a header set makes the site secure, when it closes some classes of problem and not others.