Security headers generator

← All tools

Toggle common security response headers and copy a starter block for nginx, Cloudflare Workers, or raw HTTP. For a full Content-Security-Policy use the CSP generator.

~~~

Presets

~~~

Strict-Transport-Security

Preload requires submitting your domain to the HSTS preload list — only enable when every subdomain serves HTTPS.

X-Content-Type-Options

Referrer-Policy

Permissions-Policy

Control browser features per origin. Omit a feature to leave it unrestricted.

Framing

X-Frame-Options is legacy. Prefer frame-ancestors in a CSP — use the CSP generator for that.

Cross-Origin-Opener-Policy

Cross-Origin-Resource-Policy

Legacy / optional

Modern browsers ignore this header. Setting 0 is the recommended way to turn off the old IE-era filter.

Off by default. Real sites need a tailored CSP — use the CSP generator.

~~~

Output

Shareable URL keeps your choices. Everything runs in the browser — no requests leave this page. Paste output into the headers explainer to sanity-check a live response.
~~~
About this tool
Security headers harden browsers against common attacks: forcing HTTPS (HSTS), blocking MIME sniffing, controlling referrer leakage, disabling sensitive APIs, and isolating your origin from cross-origin windows.
This is a starter set — not a complete security audit. CSP is the biggest piece and needs site-specific rules; use the CSP generator instead of guessing directives here. Test CORS separately with the CORS debugger.
~~~
Read more