HTTP Security Headers Generator

Generate HTTP security headers — CSP with frame-ancestors, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP and COEP — as ready-to-use snippets for Apache .htaccess, Nginx, Netlify _headers and Vercel vercel.json.

Developer Runs client-side Free to use

Jump to the tool

About the HTTP Security Headers Generator

HTTP Security Headers Generator builds a set of response headers and formats them for your platform. Configure a Content-Security-Policy with clickjacking protection through frame-ancestors, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy. The same headers are generated as an Apache .htaccess block, Nginx add_header lines, a Netlify _headers file and a Vercel vercel.json configuration, with values escaped correctly for each.

Each choice comes with plain-language notes about compatibility: HSTS must only be sent from sites that work fully over HTTPS and preload has its own submission requirements; strict COOP can break sign-in pop-ups; CORP can stop other sites using your files; COEP require-corp can block third-party embeds; and blocking permissions disables those features. The deprecated X-XSS-Protection header is intentionally not offered. The output is a starting point and does not replace testing or a security review.

How to use

Choose the headers and values you want, starting from the safe defaults.
Read the notes for compatibility impacts of your choices.
Pick your platform: Apache, Nginx, Netlify or Vercel.
Copy the snippet or download the configuration file.
Deploy to a staging site first and check that everything still works.

Key features

CSP with frame-ancestors clickjacking protection.
HSTS with max-age, includeSubDomains and preload checks.
X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
COOP, CORP and COEP with compatibility warnings.
Apache, Nginx, Netlify and Vercel output, correctly escaped.
Copy, Download Configuration and full Reset.

Best practices

Start HSTS with a short max-age and increase it once everything works over HTTPS.
Test COOP, CORP and COEP on a staging site before production.
Only block Permissions-Policy features your site does not use.
Re-check headers after server or CDN changes.
Keep a security review as part of your release process.

Benefits

Correct syntax for four common platforms.
Clear explanations of compatibility risks.
Modern headers only — no deprecated advice.
Private and free.

Frequently asked questions

Why isn’t X-XSS-Protection included?

It is deprecated: modern browsers ignore it, and in some older browsers it caused security problems. A Content-Security-Policy is the modern protection against cross-site scripting.

Is it safe to enable HSTS?

Only if every page of the site (and every subdomain, if you use includeSubDomains) works over HTTPS. Browsers will refuse plain HTTP for the whole max-age, so start with a short value.

Does adding preload put my site on the preload list?

No. The preload directive only signals consent. Submission is a separate process with its own requirements, and removal from the list can take months.

Why might COOP, CORP or COEP break my site?

COOP same-origin can break sign-in and payment pop-ups; CORP can block other sites from loading your files; COEP require-corp blocks cross-origin resources that do not opt in with CORP or CORS headers.

Where does the Nginx snippet go?

Inside the server { } block (or http { }). Note that add_header lines inside a nested location { } replace inherited ones, so repeat them there if needed.

Do these headers make my site secure?

No set of headers guarantees security. They reduce some risks, but you still need secure code, updates, testing and a security review.