Security Headers Generator
Choose your security headers once and get them ready for your server, host or framework.
Try before you buy.
- Free preview: the first lines of each configuration (up to 20) and the first headers of the list (up to 10), with every note about your choices.
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Safe for most sites: the CSP starts in report-only mode, and only powerful browser features are blocked.
Your headers
Browser features (Permissions-Policy)
| Feature | Allowed for |
|---|---|
Camera camera | |
Microphone microphone | |
Location geolocation | |
Screen capture display-capture | |
Payment Request payment | |
Full screen fullscreen | |
Autoplay of media autoplay | |
Picture-in-picture picture-in-picture | |
Encrypted media (DRM) encrypted-media | |
Passkeys and security keys (sign-in) publickey-credentials-get | |
Federated sign-in (FedCM) identity-credentials-get | |
One-time codes from SMS otp-credentials | |
web-share | |
Clipboard read clipboard-read | |
Clipboard write clipboard-write | |
Screen wake lock screen-wake-lock | |
USB devices usb | |
Serial ports serial | |
HID devices hid | |
Bluetooth bluetooth | |
MIDI devices midi | |
Gamepads gamepad | |
VR and AR (WebXR) xr-spatial-tracking | |
Accelerometer accelerometer | |
Gyroscope gyroscope | |
Magnetometer magnetometer | |
Idle detection idle-detection | |
Local fonts local-fonts | |
Window placement on screens window-management | |
Keyboard layout map keyboard-map | |
Storage access (third-party cookies) storage-access | |
Topics API (interest-based ads) browsing-topics | |
Ad attribution reporting attribution-reporting | |
Synchronous XMLHttpRequest sync-xhr | |
Cross-origin isolation cross-origin-isolated | |
Unload event handlers unload | |
FLoC (retired) interest-cohort |
Framing, referrer and isolation
More headers and single pages
Your configuration
The headers
| Header | Value | What it does |
|---|
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the Security Headers Generator
Security headers are a few lines of server configuration that make a whole class of attacks harder: HSTS keeps visitors on https, a Content-Security-Policy limits where scripts may come from, X-Frame-Options and frame-ancestors stop clickjacking, Permissions-Policy switches off the camera, microphone and other features your site never uses, and the Cross-Origin headers keep other sites’ windows and pages apart from yours.
Start from Recommended (safe for most sites, with the CSP in report-only mode) or Strict (the values of the OWASP Secure Headers Project), change what you need, and the page writes the configuration for nginx, Apache (virtual host or .htaccess), Caddy, IIS (web.config), the _headers file of static hosts such as Netlify, vercel.json and Express with helmet. HSTS goes on https responses only, Cache-Control: no-store and Clear-Site-Data only on the paths you name, and every choice that can break something says what and how to test it. It can also hide the headers that give away your software versions.
Without a pass the result is a free preview: the first lines of each configuration and the first headers of the list, with every note. The full configurations, and copying or downloading them, unlock with a Pro pass.
How to use it
- Choose Recommended or Strict as a starting point.
- Go through the sections and adjust: HSTS and its max-age, the Content-Security-Policy (a starter policy, OWASP’s, or your own), the browser features to block, the cross-origin and framing headers.
- Name the logout URL for Clear-Site-Data and the private pages for Cache-Control: no-store, if you want them.
- Choose your server or host under Configuration for. With a pass, or once this result is unlocked, copy or download the configuration; the free preview shows its first lines.
- Reload the server, then check the live headers with the Security Headers Checker and test your pages, especially with CSP and COEP.
Examples
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; …" always; add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), …" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "SAMEORIGIN" always;
/* Strict-Transport-Security: max-age=63072000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Referrer-Policy: no-referrer X-Frame-Options: DENY
Clear-Site-Data on /logout
header /logout Clear-Site-Data `"cache", "cookies", "storage"`
Common uses
- Fixing the missing-header findings of a scan, a penetration test or a security questionnaire.
- Moving a site to a new server or host and keeping the same headers.
- Rolling out a Content-Security-Policy safely, report-only first.
- Turning off camera, microphone and location for a site and the third-party code it embeds.
The headers and what they do
Strict-Transport-Security— browsers use only https for the site for max-age seconds. Sent on https only: browsers ignore it over http (RFC 6797). For the preload list the header needs a max-age of at least a year,includeSubDomainsandpreload(hstspreload.org).Content-Security-Policy— where scripts, styles, frames and other content may come from. Build one with the CSP Generator and check it with the CSP Evaluator.Permissions-Policy—feature=()turns a feature off,feature=(self)keeps it for your own pages; it also binds the frames you embed.Referrer-Policy— how much of your page address other sites see.strict-origin-when-cross-originsends only the origin to other sites.Cross-Origin-Opener-Policy,-Embedder-Policy,-Resource-Policy— keep other sites’ windows away from yours, load cross-origin resources only if they agree, and say who may load your files.X-Content-Type-Options: nosniff— no guessing of file types.X-Frame-Options— the older clickjacking header; CSPframe-ancestorsdoes the same in current browsers.X-Permitted-Cross-Domain-Policies: none— no cross-domain policy files for Adobe products.
The OWASP HTTP Headers Cheat Sheet recommends not sending X-XSS-Protection at all, or only 0, and never Expect-CT or Public-Key-Pins; this page offers none of those except the 0.
What can break, and how to test
- HSTS with includeSubDomains makes every subdomain https-only for max-age: check intranet, mail and old subdomains first, and start with a short max-age.
- CSP with
default-src 'self'blocks CDNs, analytics, fonts and embeds until you add them. Recommended sends it report-only, so the browser console lists what would be blocked. - COOP same-origin cuts the link to sign-in and payment popups that report back with
window.opener;same-origin-allow-popupskeeps them working. - COEP require-corp blocks images, scripts and frames of other sites that do not send
Cross-Origin-Resource-Policyor CORS. - CORP same-origin stops other sites from embedding your images and files; send
cross-originon assets meant for that. - Clear-Site-Data signs the visitor out of everything on the site: use it on the logout URL only.
After deploying, compare the live headers with the Security Headers Checker.
Limitations
- The configurations set fixed values. A CSP with a per-request nonce must be created by your application for each response; the CSP Generator explains how for nginx and Express.
- Static hosts apply _headers and vercel.json to the files they serve; responses of serverless functions and server-rendered pages must set their own headers.
- Nothing is sent to your server: the page cannot see which headers it already sends. Check them with the Security Headers Checker.
Privacy
On this device: nothing is sent
Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.
Frequently asked questions
What do I get without a pass?
Without a pass, Security Headers Generator shows the first lines of each configuration (up to 20) and the first headers of the list (up to 10), with every note about your choices. Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Which security headers does every site need?
At least Strict-Transport-Security, X-Content-Type-Options: nosniff, clickjacking protection (X-Frame-Options or CSP frame-ancestors), a Referrer-Policy and a Content-Security-Policy. Permissions-Policy and the cross-origin headers add more, at a small risk of breaking embeds: that is the difference between Recommended and Strict.
Why is the CSP report-only in Recommended?
Because a Content-Security-Policy that blocks something your site needs breaks it. In report-only mode nothing is blocked and the browser console (or your report-uri) lists every violation. When the list is empty, untick report-only.
Should I add preload to HSTS?
Only when every subdomain works over https and will stay so: the preload list is built into browsers, and the site’s own documentation warns that removal takes months to reach users. The header needs max-age of at least 31536000 and includeSubDomains; then submit the domain at hstspreload.org.
Where do the nginx lines go?
In a file that every server block (and every location with its own add_header) includes: nginx sends add_header lines only from the innermost level that has any, so a location with one add_header loses all the server’s headers. The configuration shows the include lines.
Does helmet set all of these?
Most of them, under its own option names (strictTransportSecurity, contentSecurityPolicy, xFrameOptions and so on), but not Permissions-Policy: the Express configuration adds it with a small middleware.
Does hiding the Server header make my site safer?
Only a little: it makes your software and version harder to fingerprint, nothing more. Keeping the software updated is what protects you.