Choose HSTS, CSP, framing and more, then copy the nginx, Apache or Vercel config
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 17 Oct 2026.Security headers are HTTP response headers that tell the browser to use HTTPS, block framing, stop type sniffing and limit features. This generator writes up to 11 of them, from OWASP's recommended set or a gentler profile, as ready configuration for nginx, Apache, Caddy, IIS, Netlify, Vercel or Express.
Start from a profile: Strict follows OWASP, Balanced suits most sites, Basic changes the least.
Adjust HSTS, framing, Referrer-Policy, Permissions-Policy and the cross-origin headers.
Pick your server: nginx, Apache, Caddy, IIS, Netlify, Vercel or Express.
Copy the snippet into the configuration, reload, and check the live site with the HTTP headers checker.
A web server sends none of the protective headers unless it is told to. Each one closes a specific hole, and getting the syntax right for every server is the slow part. Choose the headers once and copy the snippet for yours.
Profiles. Strict is exactly the OWASP Secure Headers Project's recommended set, checked against its published list. Balanced keeps the parts that rarely break a site. Basic changes the least.
| Header | Strict | Balanced |
|---|---|---|
| Strict-Transport-Security | 2 years, subdomains | 1 year, subdomains |
| Content-Security-Policy | OWASP starter | allows https images |
| X-Frame-Options | DENY | SAMEORIGIN |
| Referrer-Policy | no-referrer | strict-origin-when-cross-origin |
| Permissions-Policy | 29 features off | 6 features off |
| Cross-Origin-Embedder-Policy | require-corp | not sent |
HSTS. Browsers remember to use HTTPS for max-age seconds. The preload list accepts a domain only with at least 31536000 seconds, includeSubDomains and preload, and the page warns when one is missing. Start short, because a mistake is cached for the whole period.
Framing and CSP. The X-Frame-Options choice also writes the matching CSP frame-ancestors, so the old and new header never disagree. The CSP here is a starting point; check yours line by line with the CSP evaluator before you enforce it, or send it as report-only first.
Cross-origin headers. Cross-Origin-Embedder-Policy: require-corp blocks any image, script or frame from another site that does not opt in, so it is off in Balanced.
Server quirks. nginx adds headers only on success codes unless always is given, and a location with its own add_header forgets the ones above it; Apache needs mod_headers. The notes under each snippet say where it goes. Afterwards, test the live site with the HTTP headers checker. Nothing you type leaves the browser.
At least Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, a framing rule (X-Frame-Options or CSP frame-ancestors) and Referrer-Policy. Permissions-Policy and the cross-origin headers add more protection. The OWASP Secure Headers Project lists 13 recommended headers, and the Strict profile here follows it.
Add one add_header line per header inside the server block, with the always flag so error pages and redirects get them too, then run nginx -t and reload. Any location block with its own add_header loses every header set above it, so repeat the lines there or use an include file.
A valid certificate, a redirect from HTTP to HTTPS on the same host, HTTPS on every subdomain, and a Strict-Transport-Security header on the base domain with max-age of at least 31536000 seconds, includeSubDomains and preload. Removal from the list takes months, so only submit when every subdomain is ready.
With require-corp, the browser refuses any image, script, font or frame from another origin unless that response sends Cross-Origin-Resource-Policy or allows CORS. Third-party embeds and CDN images often fail. Use it only when you need cross-origin isolation, for example for SharedArrayBuffer, and test first.
Modern browsers obey frame-ancestors and ignore X-Frame-Options when both are present, but older browsers know only X-Frame-Options. Sending both costs nothing; the generator keeps them consistent, so DENY pairs with frame-ancestors 'none' and SAMEORIGIN with frame-ancestors 'self'.
No. Current browsers have removed the XSS auditor, and in older ones the filter itself could be abused to leak data; OWASP's recommended set leaves it out. A Content-Security-Policy without unsafe-inline scripts is the protection that replaces it.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about Security Headers Generator and anybody who knows can answer. No account needed.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.