By · Updated

Security Headers Generator

Build HSTS, Framing and Referrer Headers as nginx, Apache, Netlify or Cloudflare Config

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the Security Headers Generator works

A security headers generator writes the HTTP response headers that make browsers enforce HTTPS, block clickjacking, stop MIME sniffing and limit what the page can access. Pick the settings and copy ready-made config for nginx, Apache, Netlify, Cloudflare Pages or Express.

Security headers are instructions a server sends with every response. They cost nothing to add, break little when set sensibly, and are the first thing scanners such as Mozilla Observatory and securityheaders.com check. Most sites miss several of them because each server writes them in a different syntax.

What the security headers generator includes

Strict-Transport-Security (HSTS) tells the browser to use HTTPS for the domain for the given time, so a later http:// link cannot be intercepted. X-Frame-Options and the CSP frame-ancestors directive stop other sites from framing the page for clickjacking; the tool adds the matching frame-ancestors to your policy so modern and old browsers agree. X-Content-Type-Options: nosniff stops browsers guessing a file's type and running an upload as script. Referrer-Policy controls how much of the URL is sent to other sites, and strict-origin-when-cross-origin sends only the domain. Permissions-Policy switches off the camera, microphone, location, payment and USB APIs for the page and any frames in it.

Cross-origin isolation

Cross-Origin-Opener-Policy: same-origin cuts the link between your page and pop-ups opened from other sites, and Cross-Origin-Resource-Policy: same-origin stops other sites loading your files. Leave these off if you use third-party sign-in pop-ups or serve images to other domains.

Where the config goes

Put the nginx lines inside the server block; always makes them apply to error pages too. The Apache lines go in .htaccess or the virtual host and need mod_headers. Netlify and Cloudflare Pages read a _headers file in the publish folder.

FAQ

Is it safe to turn on HSTS preload?

Only when every subdomain works over HTTPS, because preload puts the whole domain into a list built into browsers and removal takes months. Start with a one-day max-age, check nothing breaks, move to a year, then submit the domain at hstspreload.org.

Do I still need X-Frame-Options if I have a CSP?

The frame-ancestors directive replaces it in every current browser, but older browsers and some scanners only look for X-Frame-Options. Sending both costs nothing, so the generator sends both with matching values.

Why is X-XSS-Protection not included?

Browsers have removed the XSS auditor that header controlled, and in some old versions turning it on created new data leaks. Current advice from OWASP and browser vendors is to leave it out and rely on a Content-Security-Policy instead.

How do I check the headers are live?

Deploy the config, then load the page with the browser's DevTools open, pick the document in the Network tab and read the response headers. Or paste the URL's headers into an HTTP header checker to see which ones are present and which are missing.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

CSP Builder

Build a Content-Security-Policy header from per-directive source lists.

HTTP Header Inspector

Parse pasted HTTP headers, explain each one and audit security.

Cache-Control Header Builder

Build a Cache-Control header and see exactly how browsers and CDNs will treat it.

CORS Tester

Test a URL for CORS headers or analyse pasted ones.

Web App Manifest Generator

Generate a PWA manifest.webmanifest with icons, colours and head tags.