Security Presets
Start with balanced, strict, or app-friendly policies.
Security Headers Generator
Generate CSP, HSTS, Referrer-Policy, Permissions-Policy, and other security headers.
CSP BuilderHSTS HeaderConfig Snippets
Security headers
Generate baseline security headers for static sites and web apps.
Header policy
HTTP headers
Drop into your edge or proxy config.
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() Cross-Origin-Opener-Policy: same-origin
Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Frame-Options "DENY" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always; add_header Cross-Origin-Opener-Policy "same-origin" always;
Next.js headers()
async headers() {
return [
{
source: '/(.*)',
headers: [
{ key: 'Content-Security-Policy', value: 'default-src \'self\'; script-src \'self\'; style-src \'self\' \'unsafe-inline\'; img-src \'self\' data: https:; font-src \'self\' data:; connect-src \'self\'; frame-ancestors \'none\'; base-uri \'self\'; form-action \'self\'' },
{ key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
{ key: 'X-Frame-Options', value: 'DENY' },
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), payment=()' },
{ key: 'Cross-Origin-Opener-Policy', value: 'same-origin' },
],
},
];
}Capabilities
What this tool handles
Use Security Headers Generator to check the input, tune the settings, and copy a clean output.
HTTP Headers
Generate deploy-ready security headers.
Server Snippets
Copy Nginx and Next.js header examples.
Workflow
Run it in three steps
Create baseline security headers for websites and apps.
1
Pick a Preset
Choose balanced, strict, or app-friendly header defaults.
2
Tune Policies
Adjust CSP, HSTS, referrer, and permissions policies.
3
Copy Snippets
Copy raw headers, Nginx config, or Next.js headers.
Good for
Common jobs this tool supports
CSP PresetsStart from practical CSP defaults
HSTS OptionsMax-age, subdomains, and preload
Config SnippetsNginx and Next.js examples
Copy HeadersCopy raw HTTP headers instantly
FAQ
Answers before you run it
Practical notes about output, privacy, and common settings.
Most sites should consider Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and frame protection.
Use next