ES
Home › Developer Tools › Security Headers Generator

Security Headers Generator

Choose the HTTP security headers your site should send and copy a ready-made configuration for Apache, Nginx, Netlify, Cloudflare Pages, a Cloudflare Worker, Vercel, Express or IIS. Presets get you started, and warnings explain what each setting might break.

Last updated:

Start from:
Framing and content type

Choose for each browser feature. "Off" sends feature=(); "Self" allows only your own origin.

Cross-origin isolation

Build a full policy with the Content Security Policy Generator.

Hide server details

Headers (0)

      
        
      
          
          
        
      
      
      
    
      
  
      
  
      
  Advertisement
  
      


  
      

      

      




      
  Advertisement
  

      



      How to use the Security Headers Generator
      

      1. Pick a preset (Basic, Recommended or Strict) or start toggling headers yourself.
      2. Adjust each header: HSTS duration, frame policy, referrer policy, permissions and isolation options.
      3. Read the warnings on the right; they flag settings that can break embeds, pop-ups or subdomains.
      4. Choose your server from the tabs: Apache, Nginx, Netlify, Cloudflare, Vercel, Express or IIS.
      5. Copy or download the config, deploy it, and verify the live headers with the HTTP Header Parser.
      

      What each header does
      

      

      HeaderTypical valueRisk of breaking things
      


      Strict-Transport-Securitymax-age=31536000; includeSubDomainsLow, if all subdomains have HTTPS
      

      X-Content-Type-OptionsnosniffVery low; files must have correct Content-Type
      

      X-Frame-OptionsSAMEORIGINLow; blocks other sites from embedding yours
      

      Referrer-Policystrict-origin-when-cross-originVery low; analytics still see the referring site
      

      Permissions-Policycamera=(), microphone=(), geolocation=()Low, if you only disable unused features
      

      Cross-Origin-Opener-Policysame-originMedium; can break OAuth and payment pop-ups
      

      Cross-Origin-Resource-Policysame-siteMedium; other sites cannot hotlink your files
      

      Cross-Origin-Embedder-Policycredentialless or require-corpHigh; third-party embeds must opt in
      

      Content-Security-PolicySite-specificHigh until tuned; start in Report-Only mode
      
      

      


      A safe rollout plan
      

        

      1. Start with the low-risk headers: nosniff, a frame policy, a Referrer-Policy and HSTS with a short max-age such as one day.
        2. 

      2. Add a CSP in Report-Only mode and watch the browser console for violations for a week. Write the policy with the Content Security Policy Generator.
        3. 

      3. Raise HSTS to one year with includeSubDomains once every subdomain serves HTTPS correctly.
        4. 

      4. Enforce the CSP and add Permissions-Policy and COOP, testing logins, payments and embedded media.
        5. 

      5. Verify the live result with the HTTP Header Parser after every change.
        6. 

      


      Frequently asked questions
      

      Which security headers should every website send?
      At a minimum: Strict-Transport-Security (on HTTPS sites), X-Content-Type-Options: nosniff, a frame policy (X-Frame-Options or CSP frame-ancestors) and a Referrer-Policy. A Content-Security-Policy and Permissions-Policy add strong protection on top. The Recommended preset sets all of these with values that rarely break sites.
      

      Is HSTS preload safe to enable?
      Only when every subdomain works over HTTPS, now and in the future. After you submit the domain at hstspreload.org, browsers ship it in their built-in list and will refuse HTTP connections for the domain and all subdomains. Removal takes months, so start with a short max-age, then use one year with includeSubDomains, and add preload last.
      

      Should I use X-Frame-Options or CSP frame-ancestors?
      CSP frame-ancestors is the modern standard and supports lists of allowed sites; when both are present, current browsers follow frame-ancestors. X-Frame-Options (DENY or SAMEORIGIN) still helps very old browsers, so sending both with matching values is a common choice. The ALLOW-FROM value of X-Frame-Options is no longer supported.
      

      Why is X-XSS-Protection set to 0?
      The browser XSS filter it controlled has been removed from Chrome, Edge and Safari, and in older browsers it could be abused to leak data from pages. OWASP and browser vendors recommend disabling it with 0 (or not sending it) and relying on a Content-Security-Policy instead.
      

      What do COOP and COEP do?
      Cross-Origin-Opener-Policy: same-origin separates your window from cross-origin pages that open it or that it opens, blocking cross-window attacks. Cross-Origin-Embedder-Policy requires every embedded resource to allow being loaded. Together they make a page cross-origin isolated, which is needed for SharedArrayBuffer, but COEP can break third-party images, videos and widgets.
      

      Why don't my Nginx headers appear on some pages?
      Nginx only inherits add_header directives from the server block when a location block has none of its own. If a location adds any header, repeat the security headers there or put them in an include file used in every location. Also use the always parameter so headers are sent on error pages.
      

      How do I check that the headers work?
      Deploy the configuration, then load your site with browser DevTools (Network tab) or run curl -I https://yourdomain and paste the response into the HTTP Header Parser. It explains each header and grades the result.
      

      Are all the tools on FreeToolCabin tested for quality and accuracy?
      Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.
      


      Related tools
      

      
HTTP Header ParserPaste raw HTTP headers to get a table explaining each one plus a security headers grade.Content Security Policy GeneratorBuild a CSP header or meta tag with nonces, hashes, presets and report-only mode.Nginx Config GeneratorBuild an nginx server block: static site, SPA, reverse proxy or PHP, with SSL, gzip and redirects.Htaccess & Nginx Redirect GeneratorBuild 301 redirects for .htaccess, Nginx and Netlify or Cloudflare _redirects.QR Code GeneratorMake QR codes for links, Wi-Fi, email and more.Barcode GeneratorCreate Code 128, EAN-13, UPC-A, EAN-8, Code 39 and ITF-14 barcodes as PNG or SVG.UUID GeneratorGenerate UUID v4 and v7 / GUIDs in bulk and copy or download them.Schema Markup Generator (JSON-LD)Create JSON-LD structured data for FAQ, Product, Article and more.Fake Data GeneratorGenerate mock data as JSON, CSV or SQL.Random String GeneratorGenerate secure random strings and tokens in bulk with any length and character set.API Key GeneratorCreate secure API keys and secrets with prefixes, checksums and SHA-256 hashes for storage.MIME Type LookupFind the MIME type for any file extension, or the extensions for a MIME type, in 400+ entries.Cron Expression GeneratorBuild crontab schedules visually, read them in plain English and see the next run times.URL Slug GeneratorTurn titles into clean, SEO-friendly URL slugs: accents, stop words, separators and bulk lines.JSON Schema GeneratorTurn sample JSON into a draft 2020-12 JSON Schema with types, required fields and formats.Gitignore GeneratorBuild a .gitignore from 50+ templates for languages, frameworks, IDEs and OS, merged and deduped.License GeneratorCreate a LICENSE file for MIT, Apache, GPL, BSD, ISC, MPL or Unlicense with your name and year.ULID GeneratorGenerate sortable ULIDs and UUID v7 in bulk, monotonic option, and decode their timestamps.Htpasswd GeneratorCreate .htpasswd entries with bcrypt, APR1-MD5 or SHA-1 for Apache and Nginx basic auth.Placeholder Image GeneratorCreate placeholder images in any size, color and text as PNG, JPG, WebP, SVG or data URI.Ads.txt GeneratorCreate or validate ads.txt and app-ads.txt files: seller lines, cert IDs and variables.Docker Run to Compose ConverterConvert docker run commands to docker-compose.yml, or a compose file back to docker run.Dockerfile GeneratorGenerate a production Dockerfile and .dockerignore for Node, Python, Go or a static nginx site.HTML Boilerplate GeneratorTick the options you need and get a clean HTML5 starter template with meta, OG tags and CSS reset.JSON to Zod SchemaInfer a Zod (or Yup) schema from sample JSON with optional, nullable and z.infer types.Linux Commands Cheat SheetSearchable Linux and bash command reference with flags explained, examples and copy buttons.LLMs.txt GeneratorBuild an llms.txt file for AI crawlers: summary and link sections, import from your sitemap.Nano ID GeneratorGenerate secure Nano IDs with custom alphabet, length and count, plus a collision calculator.OpenAPI / Swagger ViewerView OpenAPI 2/3 JSON or YAML as interactive API docs with validation and an endpoint list.package.json GeneratorFill a form and get a valid, npm-ready package.json with scripts, dependencies and checks.PKCE Code Challenge GeneratorGenerate an OAuth 2.0 PKCE code_verifier and S256 code_challenge, build auth URLs, verify pairs.README GeneratorFill in a form and get a polished README.md with badges, install, usage and license, live preview.Regex GeneratorBuild regular expressions visually from blocks or presets (email, date, phone) and test them live.Commit Message GeneratorBuild Conventional Commit messages with type, scope, body, breaking change and issue refs.Database Schema DesignerDesign tables and relationships visually, then export SQL for MySQL, PostgreSQL or SQLite.Docker Compose GeneratorBuild a docker-compose.yml with a form: services, ports, volumes, env, healthchecks and presets.Dummy File GeneratorCreate test files of an exact size in KB, MB or GB with zeros, random bytes or text.FFmpeg Command GeneratorPick a task and options, get the exact ffmpeg command with every flag explained.Markdown TOC GeneratorGenerate a linked table of contents from Markdown headings with GitHub-style anchors.OpenAPI EditorEdit OpenAPI/Swagger YAML or JSON side by side with live API docs, validation and download.OpenAPI ValidatorValidate OpenAPI 3.0/3.1 and Swagger 2.0 specs: schema errors, broken $refs, line numbers.Pivot Table MakerBuild pivot tables from CSV or Excel by drag and drop: sum, count, average, charts, export.SQL Query BuilderBuild SELECT queries visually: joins, filters, GROUP BY, ORDER BY and LIMIT, as clean SQL.Truth Table GeneratorType a logic expression and get its full truth table, minterms and canonical DNF/CNF.TypeScript PlaygroundWrite TypeScript with live type checking, see the compiled JavaScript and run it in your browser.Article Schema GeneratorCreate Article, BlogPosting or NewsArticle JSON-LD with headline, authors, dates and images.Event Schema GeneratorCreate Event JSON-LD with dates, venue or online location, tickets, organizer and performers.Google Search Query BuilderBuild advanced Google searches with site:, filetype:, intitle:, exact phrases and date operators.HowTo Schema GeneratorCreate HowTo JSON-LD with steps, tools, supplies, total time and cost, then copy it.Htaccess GeneratorBuild an Apache .htaccess file: HTTPS, www, gzip, caching, error pages, IP blocks, hotlinks.HTML Email Template BuilderDrag and drop blocks to build a responsive, table-based HTML email with inline styles.Organization Schema GeneratorCreate Organization JSON-LD with logo, URL, contact points, address and social profiles.PIN GeneratorGenerate random 4, 6 or 8-digit PINs that avoid sequences, repeats, dates and common PINs.Product Schema GeneratorBuild Product JSON-LD with price, availability, brand, GTIN, ratings and reviews.Question Keyword GeneratorFind the questions people ask about a topic, grouped by who, what, why, how, can and more.Recipe Schema GeneratorCreate Recipe JSON-LD with ingredients, steps, prep and cook times, nutrition and ratings.SKU GeneratorBuild consistent SKUs from brand, category, size and color, then export every variant as CSV.Typography Scale GeneratorBuild a modular type scale from a base size and ratio, then copy CSS variables or a Tailwind config.WordPress Salt GeneratorGenerate fresh WordPress security keys and salts for wp-config.php, .env or Docker in one click.ANSI Color Code GeneratorStyle terminal text with 16, 256 or RGB colors and get escape codes for bash, Python, JS and C.Apache Virtual Host GeneratorCreate an Apache VirtualHost config with SSL, redirects, reverse proxy or PHP-FPM in seconds.Bash Prompt GeneratorDrag and drop a custom PS1 prompt for bash or zsh with colors, git branch and a live preview.Changelog GeneratorTurn Conventional Commit messages into a grouped Keep a Changelog Markdown file per version.cURL Command BuilderBuild curl commands from a form: method, headers, query, JSON or form body, auth and flags.Docker Compose to KubernetesConvert docker-compose.yml into Kubernetes Deployment, Service, ConfigMap and PVC manifests.Docker Compose ValidatorCheck a docker-compose.yml for YAML errors, schema mistakes, broken references and deprecated keys.Dockerfile LinterLint a Dockerfile for best practices: pinned tags, apt cleanup, non-root USER and layer count.Dockerignore GeneratorBuild a .dockerignore from Node, Python, Go and Java templates, plus your own entries.

      

      See all 85 Code Generators & Builders →