HTTP Security Headers Generator

HSTS • X-Frame-Options • Referrer-Policy • Nginx, Apache & Cloudflare

Headers to Include
Forces browsers to only connect over HTTPS. Only set this if HTTPS already works site-wide — browsers remember this for the full duration below.
Controls whether your site can be embedded in an <iframe> elsewhere — the classic clickjacking defense.
Stops the browser from guessing a file's type based on its content — always set to nosniff, the only valid value.
Controls how much of your URL is sent as the Referer header when a visitor clicks a link away from your site.
Disables browser features (camera, microphone, geolocation) your site doesn't use, so they can't be silently exploited via embedded/injected content.
Server
Generated Config

            

                    
        

    


    
    

        

            
 About

            
 Contact

        

        

            
About HTTP Security Headers Generator

            
HTTP response headers like these tell the browser how to treat your site defensively — they're a lightweight, high-value complement to a Content Security Policy (if you need to build a CSP specifically, this site has a dedicated CSP Generator for that). This tool covers HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, and outputs working configuration for Nginx, Apache, or a Cloudflare Worker.

            
A few correctness details worth knowing: on Nginx, add_header only applies to 2xx/3xx responses by default, silently skipping error pages, unless the always flag is added — this tool always includes it. On Apache, the header directives are wrapped in <IfModule mod_headers.c> so the config doesn't break your site outright if that module happens to be disabled. For HSTS specifically: submitting to the browser preload list requires includeSubDomains and a max-age of at least one year — this tool enforces that automatically rather than generating a preload header that the preload list would simply reject.

            
HSTS is the one header on this list that's genuinely hard to undo. Once a browser has seen it, it will refuse to connect to your site over plain HTTP for the entire max-age duration, and if you submit to the preload list, that gets built into browsers themselves — reversing it can take months. Only enable it once HTTPS is solid across your whole domain (and subdomains, if you check that box too).