Security headers generator
Choose your web server and the protections to turn on. The generator writes Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy in the right syntax, ready to paste into the site configuration.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Choose the server: nginx, Apache, Caddy or a plain list of header lines.
- Turn on the headers you want and pick their values. HSTS offers short test durations as well as one or two years.
- Copy the result into the configuration, reload the server and check the response with
curl -I.
| Header |
Protects against |
| Strict-Transport-Security |
Downgrade to HTTP and cookie theft on public Wi-Fi |
| X-Frame-Options |
Clickjacking through invisible frames |
| X-Content-Type-Options: nosniff |
Browsers guessing a file is a script or a style |
| Referrer-Policy |
Full URLs with tokens or IDs leaking to other sites |
| Permissions-Policy |
Embedded content asking for the camera, microphone or location |
| Cross-Origin-Opener-Policy |
Other windows keeping a handle to yours (cross-window attacks) |
Worked example
With the defaults and nginx selected, the generator writes:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
The word always makes nginx add the headers to error pages too.
Common mistakes
- add_header inside a location cancels all add_header lines inherited from the server block for that location. Repeat them there or keep them in one place.
- Turning on preload too early. Getting a domain off the preload list takes months.
- Blocking a feature you use. The Permissions-Policy here turns off camera, microphone and geolocation for every origin, including your own pages; leave it off if the site needs them.
Frequently asked questions
Which security headers should every site send?
A common baseline is Strict-Transport-Security for HTTPS sites, X-Content-Type-Options: nosniff, X-Frame-Options or a CSP frame-ancestors rule against clickjacking, and a Referrer-Policy. A Content-Security-Policy adds the most protection but needs tuning per site; build it with the CSP header builder.
Is it safe to turn on HSTS?
Only once the whole site, and with includeSubDomains every subdomain, works over HTTPS. Browsers then refuse plain HTTP for the max-age period. Start with 5 minutes or a day, check everything, then raise it to a year.
What does preload do?
It asks to be included in the HSTS preload list built into browsers, so even the first visit uses HTTPS. The list requires max-age of at least 31536000, includeSubDomains and preload, and you submit the domain at hstspreload.org. Removal takes a long time, so be sure.
DENY or SAMEORIGIN for X-Frame-Options?
DENY stops every site, including yours, from showing your pages in a frame. SAMEORIGIN allows frames from your own origin only. If you need to allow specific other sites, use the CSP frame-ancestors directive instead.
Why is X-XSS-Protection set to 0?
Current browsers no longer have the XSS filter this header controlled, and in older ones the filter could itself be abused. Sending 0 switches it off where it still exists; a Content-Security-Policy is the modern protection.