Security Headers Generator
Generate security HTTP headers including CSP, HSTS, X-Frame-Options, and more.
CSP, HSTS, and X-Frame-Options each defend against a completely different kind of attack, CSP restricts which script sources a page will actually execute to blunt cross-site scripting, HSTS forces every connection over HTTPS to prevent a downgrade to plain HTTP, and X-Frame-Options stops a page from being embedded inside someone else's iframe to prevent clickjacking, three distinct defenses easy to conflate as one generic security setting. This tool generates the actual header syntax for each of these protections and more, ready to drop into a server config rather than assembled from scattered documentation.
See moreSee less about the Security Headers Generator
Useful for adding a Content-Security-Policy without hand-writing its directive syntax, enabling HSTS correctly on a domain that's fully moved to HTTPS, or preventing a page from being framed by an unrelated site through clickjacking.
Key features
- Clean interface
- Fast processing
- No signup required
- Works offline