Is Security Headers Generator free to use?

Yes, Security Headers Generator is completely free. No account, no sign-up, and no hidden fees required.

Does Security Headers Generator work offline?

Security Headers Generator runs entirely in your browser. Once the page is loaded, most features work without an internet connection.

Is my data safe when using Security Headers Generator?

Your data never leaves your device. All processing happens locally in your browser — nothing is uploaded to any server.

Developer Tools

Security Headers Generator

Generate HTTP security headers for HSTS, CSP, X-Frame-Options, CORS and more — export for Nginx, Apache, Express, or Next.js

Trusted by 10k+ developers

Security Headers

Info Headers

Warnings

Strict-Transport-Security (HSTS)

Forces HTTPS for all future visits

Max Age (seconds):includeSubDomainspreload

Content-Security-Policy

Restricts resource loading sources

X-Frame-Options

Prevents clickjacking attacks

X-Content-Type-Options: nosniff

Prevents MIME-type sniffing

Referrer-Policy

Controls referrer header in requests

Permissions-Policy

Controls browser features (camera, mic, location…)

X-XSS-Protection: 1; mode=block

Legacy XSS filter (deprecated in modern browsers)

CORS Headers

Control cross-origin resource sharing

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'";
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header X-XSS-Protection "1; mode=block";