Free generator, runs in your browser

Security Headers Generator

Choose the headers and their values, pick your platform, and copy a configuration for Nginx, Apache, Cloudflare, Netlify or Vercel.

Generate headers

Choose the headers and the platform. The configuration updates as you go.

Why use the Security Headers Generator

Five platforms

Nginx, Apache, Cloudflare and Netlify _headers, and vercel.json.

Safe defaults

Starts with values that are safe for almost every site, with a report-only CSP to begin with.

Explained

Each header comes with one line on what it does, so you know what you ship.

Private

Everything runs in your browser.

When to use the Security Headers Generator

Hardening

Add the baseline headers every site should send.

Static hosting

Write a _headers file for Netlify or Cloudflare Pages.

Next.js on Vercel

Get the headers block for vercel.json.

Self hosted

Paste a ready block into an Nginx server or an Apache virtual host.

Rolling out CSP

Start with report-only and enforce once the reports are clean.

Security reviews

Close the header findings of a scanner in one change.

Understanding Security Headers

How to use the generator

1Pick the headers. The safe set is selected by default.
2Tune the values. Adjust HSTS, the CSP sources and the framing policy for your site.
3Pick the platform. The output switches to that platform's syntax.
4Deploy and check. Deploy the configuration, then run the security headers checker.

The safe baseline

X-Content-Type-Options: nosniff, a Referrer-Policy of strict-origin-when-cross-origin, framing limited to your own origin and HSTS once the whole site is on HTTPS. These rarely break anything.

The careful one: CSP

A Content-Security-Policy can break scripts, fonts and embeds if it is too strict. Ship it as Content-Security-Policy-Report-Only first, watch the browser console and the reports, then switch to enforcing.

Privacy and availability

The generator runs entirely in your browser. Nothing you type is sent to Aback or anywhere else, and it keeps working offline once the page has loaded.

Copy or download the result and publish it on your own site. Then check the live file with the matching checker, because what crawlers see is what your server sends.

Related tools and guides

Security Headers CheckerSecurity headers tell browsers to stay on HTTPS, refuse to be framed, stop guessing content types and limit what scripts may do. Check which ones your site sends and how they are set.SSL and HTTPS CheckerA trusted certificate is only part of HTTPS. Check that the handshake succeeds, that http redirects to https, that HSTS keeps browsers on https and that no resource is loaded insecurely.Robots.txt GeneratorWrite a correct robots.txt in a minute. Pick a policy for AI crawlers, list the paths to keep crawlers out of, add your sitemap and copy the file.Meta Tag GeneratorWrite the head of a page with a live preview of the search result and the social card. Copy the tags into your template when they look right.Schema Markup GeneratorPick a type, fill in the fields and copy valid JSON-LD. The generator includes the properties search engines require and recommend for each type.Redirect CheckerFollow every redirect of an address, hop by hop. Find chains that slow crawlers down, loops that break pages, and host variants that split your signals across duplicates.Guide: Security headers guideThe HTTP security headers every website should send, what each one protects against, safe values to start with, and how to roll out a Content-Security-Policy without breaking the site.

Frequently asked questions

Is it safe to copy these headers to production?

The baseline headers are safe for almost every site. Ship the CSP in report-only mode first, and enable HSTS only when every page works over HTTPS.

Where does the Nginx block go?

Inside the server block of the site, or in an included file. Use the always parameter so the headers are sent on error pages too.

Does Cloudflare need the _headers file?

Cloudflare Pages and Workers static assets read _headers. For a proxied origin, use Transform Rules or set the headers at the origin.

What is Permissions-Policy?

A header that turns off browser features the site does not use, such as the camera, the microphone or geolocation.

Should I add X-XSS-Protection?

No. Browsers removed the feature. A Content-Security-Policy replaces it.

What does frame-ancestors 'self' do?

It allows only your own site to put your pages in a frame, which protects against clickjacking.

How do I check the result?

Run the security headers checker on the live site after deploying.