Security Headers Generator

Generate security response header configs for Nginx, Apache, Express and more.

HSTS

RecommendedHSTS

Enforce HTTPS connections and prevent protocol downgrade attacks.

max-age (seconds)

includeSubDomains

preload

X-Frame-Options

RecommendedControl whether the page can be embedded in an iframe, preventing clickjacking.

Control whether the page can be embedded in an iframe, preventing clickjacking.

Value

X-Content-Type-Options

Recommendednosniff

Prevent browser MIME type sniffing. Fixed value: nosniff.

X-XSS-Protection

DeprecatedLegacy Browser

Legacy IE XSS filter. Deprecated in modern browsers; use CSP instead.

Value

Referrer-Policy

RecommendedControl Referer header leakage to prevent sensitive URL exposure.

Control Referer header leakage to prevent sensitive URL exposure.

Value

Permissions-Policy

Control browser feature permissions (camera, microphone, geolocation, etc.).

Cross-Origin-Opener-Policy

COOP

Isolate browsing context to prevent cross-origin window interaction (Spectre mitigation).

Cross-Origin-Embedder-Policy

COEP

Require all cross-origin resources to carry CORP header or CORS credentials.

Cross-Origin-Resource-Policy

CORP

Restrict which origins can load a resource.

Value

Output Format

Select target server/framework for configuration

Generated Result

# Security response headers config - add to server block
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;

Usage

Features

HTTP security response headers are a critical part of browser security, defending against clickjacking, MIME sniffing, XSS, and more.

Steps

Check the security headers you want to enable, adjust their values, and select an output format. Configuration is generated in real time.

Notes

Ensure full HTTPS deployment before enabling HSTS. HSTS preload list is difficult to undo.