Security Headers Generator

Our security headers generator turns a few simple choices into ready-to-paste configuration for Nginx, Apache, Netlify or PHP. You pick how strict HSTS should be, who may frame your pages, how much referrer information to share and which browser features to switch off, and the config updates as you click. It runs entirely in your browser. It is designed for small business owners, developers and agencies who want the core HTTP security headers in place correctly without memorising the syntax for each server.

How to use the Headers generator

1. 1 Choose your HSTS settingsLeave HSTS on and pick a max-age, from five minutes for testing to two years. Only tick includeSubDomains and preload once every subdomain works over HTTPS.
2. 2 Pick framing, referrer and nosniff optionsSAMEORIGIN and strict-origin-when-cross-origin are selected by default and suit most sites. Keep X-Content-Type-Options: nosniff ticked.
3. 3 Select features to switch offCamera, microphone, geolocation and USB are denied by default. Leave payment unselected if you take card or wallet payments on your site.
4. 4 Copy the config for your serverChoose the Nginx, Apache, Netlify or PHP tab, copy it into place, and then run our security headers checker to confirm the headers are being sent.

What a security headers generator gives you

Security headers are short lines your server sends with every response, instructing the browser to apply extra protection: always use HTTPS, do not guess file types, do not let other sites frame this page, keep the referring URL private and refuse access to the camera or microphone. Each one is simple, but the exact syntax differs between Nginx, Apache, Netlify and application code, and small mistakes mean the header is silently ignored.

This security headers generator produces the full set in the right format for your platform. Alongside the headers you choose, the Nginx output adds server_tokens off to hide the version number, while the Apache and PHP output remove the X-Powered-By header that can reveal your PHP version. Content-Security-Policy is not included here, because it needs tailoring to your own scripts; use our CSP generator for that. The legacy X-XSS-Protection header is deliberately left out.

How each option in the HTTP header generator works

Everything is generated in the browser as you change options, so you can experiment freely. Nothing is saved, so copy the config before leaving the page.

• Strict-Transport-Security: on by default with max-age=31536000 (one year). The other choices are 300 seconds for testing, one day for a trial, six months as a minimum and two years for preload. includeSubDomains and preload are added only when ticked, and the tool warns if preload is chosen without includeSubDomains and at least one year.
• X-Frame-Options: SAMEORIGIN (only your own site may frame your pages), DENY (nobody may) or leave it out.
• Referrer-Policy: strict-origin-when-cross-origin (full URL within your site, domain only elsewhere), strict-origin, same-origin, no-referrer, or off.
• X-Content-Type-Options: nosniff, on by default.
• Permissions-Policy: each selected feature is denied with an empty allow-list, for example camera=(). Camera, microphone, geolocation and USB start selected; payment does not.
• Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy: optional, both set to same-origin when ticked.

Where to paste the generated config

Nginx: paste the lines inside your server { } block, usually in a file under /etc/nginx/sites-available. Every line includes the always flag so headers are sent on error pages and redirects too. Run nginx -t to check the syntax, then reload. If any location block in the same server already uses add_header, repeat the lines there, because Nginx drops inherited headers from a block that defines its own.

Apache and cPanel: the Apache output is wrapped in an IfModule mod_headers.c block, so it will not take the site down if the module is missing. Paste it into the virtual host or into the .htaccess file in your public_html folder using cPanel File Manager. LiteSpeed hosting reads the same directives.

Netlify: save the output as a file called _headers in your publish directory. The /* line applies the headers to every path.

PHP: run the header() calls before any output, for example at the top of your front controller or a bootstrap file. For WordPress, put them in a small must-use plugin hooked to send_headers rather than in a theme, so they survive theme changes.

Cloudflare: if you cannot edit your server, add each header as a response header transform rule instead. HSTS has its own setting under SSL/TLS, Edge Certificates.

Choosing HSTS settings safely

HSTS is the most valuable header in the set and the one with lasting consequences. Once a browser has seen it, it will refuse to load your site over plain HTTP until max-age runs out, even if you later remove the header. That is the point, but it means a broken HTTPS setup becomes an outage for returning visitors.

A safe rollout uses the generator's presets in order: five minutes while you test, one day as a trial, then six months or a year once you are confident. Before ticking includeSubDomains, list every subdomain, including mail, staging, old campaign sites and anything a supplier hosts for you, and confirm each one has a valid certificate.

Preload asks browsers to hard-code your domain as HTTPS-only. To be accepted, the header must be served on the bare domain with a max-age of at least 31536000 seconds, includeSubDomains and preload, and HTTP must redirect to HTTPS on the same host first. Removal from the list takes months to reach users, so only preload a domain you are sure will stay on HTTPS everywhere.

Permissions-Policy and cross-origin headers explained

Permissions-Policy lets you turn off powerful browser features your site never uses. Denying camera, microphone, geolocation and USB means that even if a malicious script is injected, or a third-party embed misbehaves, it cannot prompt visitors for those permissions. Deny only what you genuinely do not use: a store locator needs geolocation, and checkout pages using browser payment features need payment left unselected.

Cross-Origin-Opener-Policy: same-origin cuts the link between your page and any window it opens or was opened from, which protects against some cross-window attacks. It can also break sign-in pop-ups and payment windows that talk back to your page, so test logins and checkout before keeping it. Cross-Origin-Resource-Policy: same-origin stops other sites loading your images, scripts and files directly. If your files are served from a separate subdomain or embedded by partners, it may block them, so leave it off or switch to same-site in your own config.

Security headers best practice and maintenance

Security headers will not fix vulnerable code, but they are quick, free and reduce the damage when something does go wrong. Keep software patched and treat headers as a standard part of every site build and handover.

• Set headers in one layer only, either the server, the CDN or the application, to avoid duplicate or conflicting values.
• Run the security headers checker after deploying and after every server move, CDN change or major plugin update.
• Check headers with curl -I as well as the browser, as some caches serve old responses to logged-in users.
• Set expose_php = Off in php.ini as well as removing X-Powered-By, so PHP does not add it in the first place.
• Add a Content-Security-Policy once the basics are in place, starting in report-only mode.

Examples you can copy

add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), usb=()" always;
# Hide the version banner
server_tokens off;

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), usb=()"
    Header always unset X-Powered-By
</IfModule>

/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), usb=()

<?php
header('Strict-Transport-Security: max-age=31536000');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: camera=(), microphone=(), geolocation=(), usb=()');
header_remove('X-Powered-By');

Common mistakes to avoid

Frequently asked questions