Security header builder

Build the response headers an audit looks for, with each one explained before you send it.

These generators run in your browser, so they need JavaScript enabled. Everything explained on this page is still readable without it.

Nothing is sent anywhere. Reload to clear.

Format Strict-Transport-Security
Forces HTTPS for a year. Only add this once every page, image and script already answers over HTTPS: a browser that has seen it will refuse plain HTTP for that year and you cannot take it back early. Content-Security-Policy
The strongest control here and the easiest to break a site with. The starter below allows your own origin only, so an external font, analytics script or embedded video will stop loading until you list it. The uncontroversial four
nosniff, frame protection, a referrer policy and a permissions policy. These break almost nothing and are what a technical audit looks for first.

Test on a staging copy, not on the live site

A header is sent to every visitor at once. A wrong Content-Security-Policy does not warn you, it silently stops your own scripts from running, and Strict-Transport-Security cannot be withdrawn from a browser that has already cached it.

Add to your server configuration

Choose a format to build the headers.

What these do and do not do

Security headers are not a ranking factor, and any tool implying otherwise is selling you something. What they are is the thing a technical audit checks, and the cheapest defence you can deploy against clickjacking, MIME confusion and referrer leakage.

They are also the only fix on this site you can apply once and forget, which is why they are worth the ten minutes.

Also in files and rules

All 18 tools