100% local and secure
Your data stays on your device and is never sent to our servers.
Security headers generator
Configure key HTTP protections for your site and get a set of security headers ready to integrate into your server configuration.
- 100% local
- Instant
- Free
- No account
- Works offline
- Clipboard
Preset
Strict-Transport-Security (HSTS)
Enable X-Content-Type-Options: nosniff
Referrer-Policy
One directive per line or separated with commas.
HTTP headers
HTTP headers
Nginx configuration
Apache configuration
Why use this tool?
Generate a consistent set of HTTP headers to strengthen your website security. Everything stays local.
Smart processing
Generate or verify sensitive data with clear and immediate controls.
Supported formats
Strings, keys, hashes, and technical formats depending on the security function.
Save time
Get a clean, ready-to-use result in seconds without installing software or configuring a complex workflow.
Guide
How to use this tool
- 1
Choose a preset
Start with a balanced, strict, or compatible configuration.
- 2
Adjust policies
Tune HSTS, referrer, permissions, and cross-origin isolation.
- 3
Deploy and test
Copy the server-specific output and verify real behavior.
Tips and best practices
- Enable HSTS only when the entire site is available over HTTPS.
- HSTS preload is a long-term commitment to review before submission.
- COEP and COOP may block incompatible third-party resources.
Frequently asked questions
Do these headers replace a CSP?
No. They complement a Content Security Policy but address different risks.
Can I copy them unchanged?
Use them as a starting point, then test every feature and third-party resource.
Why keep X-Frame-Options?
It remains useful for older browsers even though CSP frame-ancestors is more modern.
Was this tool useful?
Read next
GuideBest practicesBeginner
Content Security Policy (CSP): reduce XSS risks and unwanted loads
Learn how to introduce a CSP progressively, understand its main directives, Report-Only mode, nonces and common mistakes.
29 August 20261 minRead
GuideBest practicesBeginner
HTTP security headers: which ones to enable and why
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.
29 August 20261 minRead
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 minRead
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 minRead
Recommended workflow
Continue your processing
Discover tools that naturally fit before, after, or alongside this one.
Complementary tools
Security & privacy
CSP generator
Create a Content Security Policy to strengthen your website security.
100% local
Use this toolSecurity & privacy
AES Encrypt & Decrypt
Encrypt and decrypt text locally with AES-256-GCM and a password.
100% localNew
Use this toolSecurity & privacy
X.509 Certificate & CSR Inspector
Inspect an X.509 certificate or CSR in PEM format locally.
100% localNew
Use this tool