Security headers generator
Toggle common security response headers and copy a starter block for nginx, Cloudflare Workers, or raw HTTP. For a full Content-Security-Policy use the CSP generator.
Presets
Strict-Transport-Security
Preload requires submitting your domain to the HSTS preload list — only enable when every subdomain serves HTTPS.
X-Content-Type-Options
Referrer-Policy
Permissions-Policy
Control browser features per origin. Omit a feature to leave it unrestricted.
Framing
X-Frame-Options is legacy. Prefer frame-ancestors in a CSP — use the CSP generator for that.
Cross-Origin-Opener-Policy
Cross-Origin-Resource-Policy
Legacy / optional
Modern browsers ignore this header. Setting 0 is the recommended way to turn off the old IE-era filter.
Off by default. Real sites need a tailored CSP — use the CSP generator.
Output
Shareable URL keeps your choices. Everything runs in the browser — no requests leave this page. Paste output into the headers explainer to sanity-check a live response.
About this tool
Security headers harden browsers against common attacks: forcing HTTPS (HSTS), blocking MIME sniffing, controlling referrer leakage, disabling sensitive APIs, and isolating your origin from cross-origin windows.
This is a starter set — not a complete security audit. CSP is the biggest piece and needs site-specific rules; use the CSP generator instead of guessing directives here. Test CORS separately with the CORS debugger.
Read more
Free books, courses, and software
Get my programming books, course editions, and complete software.
Get the download library →