Skip to main content
Bethemesh
Security & privacy

Security Headers Generator

Configure HTTP security headers from a balanced, strict or compatible preset: HSTS (max-age, includeSubDomains, preload), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP and X-Frame-Options, with raw, Nginx and Apache output and configuration warnings.

  • Clipboard

Embed this widget

Customize the result, check the live preview, then copy the code.

Preview

Embed code type

Code to copy

Responsive and automatically resized by Bethemesh.

Preset

Strict-Transport-Security (HSTS)

Enable X-Content-Type-Options: nosniff

Referrer-Policy

One directive per line or separated with commas.

HTTP headers

HTTP headers

Nginx configuration

Apache configuration

Was this tool useful?

How does this tool work?

This generator produces the HTTP security headers expected from a production website: HSTS, nosniff, Referrer-Policy, Permissions-Policy, cross-origin isolation and iframe protection. It is aimed at developers and sysadmins who want a consistent, explained Nginx or Apache configuration instead of a random copy-paste.

Each header addresses a specific risk. `Strict-Transport-Security: max-age=31536000; includeSubDomains` (RFC 6797) forces the browser to use HTTPS only for one year; the hstspreload.org preload list additionally requires at least 31536000 seconds, includeSubDomains and preload. `X-Content-Type-Options: nosniff` stops the browser from guessing a response's MIME type. `Referrer-Policy: strict-origin-when-cross-origin` sends only the origin to other sites. `Permissions-Policy: camera=(), microphone=(), geolocation=()` disables those APIs for the page and its iframes.

The isolation headers work together: `Cross-Origin-Opener-Policy: same-origin` separates your window from pop-ups of other origins, `Cross-Origin-Resource-Policy` restricts who may load your resources, and `Cross-Origin-Embedder-Policy: require-corp` (or credentialless) only accepts resources that explicitly allow it; COOP + COEP make the page "cross-origin isolated", which SharedArrayBuffer requires. X-Frame-Options (DENY or SAMEORIGIN) blocks iframe embedding against clickjacking. The tool outputs these headers as raw text, Nginx `add_header … always;` directives and Apache `Header always set …` lines, and warns about HSTS shorter than 180 days, preload without includeSubDomains, a leaky Referrer-Policy, and missing nosniff or frame protection.

How to use this tool

  1. Pick a preset

    Start from Balanced (loaded by default), Strict or Compatible: every field is prefilled with its values.

  2. Adjust each header

    Set HSTS (on/off, max-age in seconds, subdomains, preload), nosniff, Referrer-Policy, X-Frame-Options, COOP, CORP and COEP, and type the Permissions-Policy directives one per line or comma-separated.

  3. Generate and copy

    Click "Generate headers", read the warnings, then copy or export the raw, Nginx or Apache version.

Use cases

Get an A on a header scanner

Securityheaders.com or Mozilla Observatory flags missing headers: generate the Balanced preset, add it to your Nginx server block and run the scan again.

Prepare an HSTS preload submission

Check that max-age is at least one year and that includeSubDomains and preload are present before submitting the domain on hstspreload.org.

Enable SharedArrayBuffer or WebAssembly threads

The Strict preset combines COOP same-origin and COEP require-corp, the two headers a page needs to be cross-origin isolated.

Examples

Four protective HTTP headers

Input

Enable HSTS: on; max-age duration (seconds): 31536000; Include subdomains: on; Request preload: off; Enable X-Content-Type-Options: nosniff: on; Referrer-Policy: strict-origin-when-cross-origin; X-Frame-Options: DENY

Result

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: DENY
No warnings

Tips and best practices

  • In Nginx, an `add_header` inside a location block cancels every one inherited from the server block: repeat the security headers in each location that defines its own.
  • Start HSTS with a short max-age (300 s, then a week) if some subdomains are not on HTTPS yet: a long value or preload is hard to roll back.
  • Turn on COEP require-corp only after checking your third-party resources (images, fonts, videos): those that send neither CORP nor CORS headers will be blocked.

Sources and references

Frequently asked questions

Which HTTP security headers should a website have?

The OWASP baseline includes Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, frame protection (X-Frame-Options or frame-ancestors) and, depending on your needs, Permissions-Policy and the COOP/CORP/COEP headers. The CSP is built separately with the CSP generator.

What max-age should I use for HSTS?

One year (31536000 seconds) is the common value and the minimum for the preload list; two years (63072000) is often recommended. During a migration, start short and increase step by step, because the browser remembers the rule for the whole duration.

Should I still add X-XSS-Protection?

No. The browser XSS filter has been removed and OWASP recommends not sending this header (or setting it to 0), because it could introduce vulnerabilities. Modern XSS protection relies on a Content Security Policy, which is why the tool does not offer it.

X-Frame-Options DENY or SAMEORIGIN?

DENY forbids any iframe embedding of your pages; SAMEORIGIN only allows it from your own origin, useful for an admin area or editor that frames itself. ALLOW-FROM is obsolete: to allow one specific domain, use frame-ancestors in the CSP.

Why are my images or fonts blocked after adding COEP?

Cross-Origin-Embedder-Policy: require-corp rejects any cross-origin resource that does not send Cross-Origin-Resource-Policy or CORS headers. Ask the provider to add them, load the resource with crossorigin, or use the more tolerant credentialless value.

How do I add these headers in Nginx or Apache?

In Nginx, paste the `add_header … always;` lines into the server block (always also sends them on error responses), then reload with `nginx -t && nginx -s reload`. In Apache, enable mod_headers and place the `Header always set …` lines in the VirtualHost or an .htaccess file.

Related tools

Keep going with these tools

Tools similar or complementary to this one.

Similar tools

CSP Generator

Build a Content Security Policy directive by directive, with HTTP header, meta tag and warnings.

Security & privacyUse this tool

HTTP Header Analyzer

Analyze HTTP headers to review security, caching, CORS, and cookie behavior.

Security & privacyUse this tool

Read next