Write the add_header lines that give an nginx site HSTS, CSP and other security headers
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.nginx sends a header only when an add_header line asks for it, and a location with its own add_header drops every header set above it. Pick the headers here and copy add_header lines with the always flag, so they are sent on error pages and redirects too. The Strict profile matches the OWASP Secure Headers recommendations; Balanced keeps images from other sites and pop-up logins working.
Paste or type your input.
Choose the options you need.
Press Ctrl+Enter, then copy or download.
A web server sends none of the protective headers unless it is told to. Each one closes a specific hole, and getting the syntax right for every server is the slow part. Choose the headers once and copy the snippet for yours.
| Header | Strict | Balanced |
|---|---|---|
| Strict-Transport-Security | 2 years, subdomains | 1 year, subdomains |
| Content-Security-Policy | OWASP starter | allows https images |
| X-Frame-Options | DENY | SAMEORIGIN |
| Referrer-Policy | no-referrer | strict-origin-when-cross-origin |
| Permissions-Policy | 29 features off | 6 features off |
| Cross-Origin-Embedder-Policy | require-corp | not sent |
Server quirks. nginx adds headers only on success codes unless always is given, and a location with its own add_header forgets the ones above it; Apache needs mod_headers. The notes under each snippet say where it goes. Afterwards, test the live site with the HTTP headers checker. Nothing you type leaves the browser.
The rest of the article, and all 6 questions about Security Headers Generator, are on the Security Headers Generator page.
At least Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, a framing rule (X-Frame-Options or CSP frame-ancestors) and Referrer-Policy. Permissions-Policy and the cross-origin headers add more protection. The OWASP Secure Headers Project lists 13 recommended headers, and the Strict profile here follows it.
Add one add_header line per header inside the server block, with the always flag so error pages and redirects get them too, then run nginx -t and reload. Any location block with its own add_header loses every header set above it, so repeat the lines there or use an include file.
A valid certificate, a redirect from HTTP to HTTPS on the same host, HTTPS on every subdomain, and a Strict-Transport-Security header on the base domain with max-age of at least 31536000 seconds, includeSubDomains and preload. Removal from the list takes months, so only submit when every subdomain is ready.
Modern browsers obey frame-ancestors and ignore X-Frame-Options when both are present, but older browsers know only X-Frame-Options. Sending both costs nothing; the generator keeps them consistent, so DENY pairs with frame-ancestors 'none' and SAMEORIGIN with frame-ancestors 'self'.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about Security Headers Generator and anybody who knows can answer. No account needed.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.