HTTP Security Headers Generator
Tick the security headers you want — HSTS, X-Frame-Options, Referrer-Policy and more — and get a ready-to-paste snippet for Nginx, Apache, IIS, Netlify or Cloudflare.
About this tool
These headers tell browsers to protect your visitors: Strict-Transport-Security makes browsers use HTTPS for your site even if someone types http://, X-Content-Type-Options stops them treating an upload as a script, X-Frame-Options stops other sites loading yours in a hidden frame to trick clicks, Referrer-Policy limits what your URLs reveal to other sites, and Permissions-Policy switches off features such as the camera that your site doesn't use. Content-Security-Policy is the most powerful of all and has its own CSP Builder.
Be careful with HSTS: once a browser has seen it, it refuses plain HTTP for the whole max-age, so start with a short value and only add preload (which needs includeSubDomains and at least a year) when every subdomain works over HTTPS. Old headers such as X-XSS-Protection are left out on purpose, as modern browsers ignore them. Check the result with your browser's developer tools after deploying.