Build a Strict-Transport-Security header and check it against the preload list rules
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.Strict-Transport-Security tells browsers to use HTTPS for your domain for max-age seconds. Choose the duration and whether subdomains are covered, and the header is written with a warning when it would not qualify for the HSTS preload list, which needs at least 31536000 seconds, includeSubDomains and preload. Start with a short max-age, then raise it once every subdomain serves HTTPS.
Paste or type your input.
Choose the options you need.
Press Ctrl+Enter, then copy or download.
A web server sends none of the protective headers unless it is told to. Each one closes a specific hole, and getting the syntax right for every server is the slow part. Choose the headers once and copy the snippet for yours.
| Header | Strict | Balanced |
|---|---|---|
| Strict-Transport-Security | 2 years, subdomains | 1 year, subdomains |
| Content-Security-Policy | OWASP starter | allows https images |
| X-Frame-Options | DENY | SAMEORIGIN |
| Referrer-Policy | no-referrer | strict-origin-when-cross-origin |
| Permissions-Policy | 29 features off | 6 features off |
| Cross-Origin-Embedder-Policy | require-corp | not sent |
HSTS. Browsers remember to use HTTPS for max-age seconds. The preload list accepts a domain only with at least 31536000 seconds, includeSubDomains and preload, and the page warns when one is missing. Start short, because a mistake is cached for the whole period.
The rest of the article, and all 6 questions about Security Headers Generator, are on the Security Headers Generator page.
At least Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, a framing rule (X-Frame-Options or CSP frame-ancestors) and Referrer-Policy. Permissions-Policy and the cross-origin headers add more protection. The OWASP Secure Headers Project lists 13 recommended headers, and the Strict profile here follows it.
Add one add_header line per header inside the server block, with the always flag so error pages and redirects get them too, then run nginx -t and reload. Any location block with its own add_header loses every header set above it, so repeat the lines there or use an include file.
A valid certificate, a redirect from HTTP to HTTPS on the same host, HTTPS on every subdomain, and a Strict-Transport-Security header on the base domain with max-age of at least 31536000 seconds, includeSubDomains and preload. Removal from the list takes months, so only submit when every subdomain is ready.
Modern browsers obey frame-ancestors and ignore X-Frame-Options when both are present, but older browsers know only X-Frame-Options. Sending both costs nothing; the generator keeps them consistent, so DENY pairs with frame-ancestors 'none' and SAMEORIGIN with frame-ancestors 'self'.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about Security Headers Generator and anybody who knows can answer. No account needed.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.