Tool
Security headers generator
Runs entirely in your browser. Nothing you enter is sent anywhere or stored.
How to use it
Choose the headers and values you want, then copy the configuration for your server.
How this works
- Generates the same headers this site uses, for Cloudflare Pages, nginx, Apache and Caddy.
- Test on a staging site first. A strict Content-Security-Policy breaks inline scripts and styles, and browsers remember HSTS for the whole max-age.
- I reject line breaks in values, so the output cannot smuggle in extra headers.