Security Headers Generator
Switch on the headers you want, set their values and copy the result. Settings that are hard to undo come with a clear warning.
Worked examples
A cautious starting set
HSTS for 1 day, nosniff on, Referrer-Policy strict-origin-when-cross-origin, framing only by my own site
Strict-Transport-Security: max-age=86400, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN
Raise the HSTS time as you confirm that every part of the site works over HTTPS.
About Security Headers Generator
Security headers are short instructions your site sends with every page to switch on protections that are already built into browsers. They need no changes to your pages, only to your hosting settings, and they close off whole classes of attack. Strict-Transport-Security makes a browser use HTTPS only for your site after the first visit. X-Content-Type-Options stops files being treated as a different type from the one you declared. Referrer-Policy limits how much of your address is passed on to other sites, and the cross-origin policies keep your pages apart from windows and resources of other sites.
This generator lets you choose each header and its value, and writes the lines to add, as header lines or as a list of names and values. Some settings are easy to get wrong, so the page warns you. A long HSTS time with sub-domains can lock visitors out of any part of your site that does not yet work over HTTPS, joining the preload list is very hard to undo and has rules the tool checks, and a strict embedder policy blocks anything from other sites that has not agreed to be loaded.
How to use Security Headers Generator
- Set how long browsers should insist on HTTPS, starting small if the site is new to HTTPS.
- Choose a referrer policy and a framing rule, and tick the other protections you want.
- Read the warnings under the form, then copy the lines.
- Add them in your hosting settings, then run a headers checker on the live site.
Common uses
- Hardening a small business website after a security review
- Adding HSTS in careful steps
- Stopping other sites from framing your pages
- Getting a better grade from a headers checker
Frequently asked questions
How long should the HSTS time be?
Start at 5 minutes while you test, then raise it to a day, a week and a month as you confirm nothing breaks. A year is the usual final value and the minimum for the preload list.
What does preload do?
It asks browsers to build your domain into their list so they use HTTPS even on the very first visit. It needs a year or more, include sub-domains and a working HTTPS site. It can take months to remove, so only do it when you are sure.
Which Referrer-Policy is a good default?
strict-origin-when-cross-origin sends the full address to your own pages, only the site name to other sites over HTTPS and nothing when moving to a less protected site. Browsers use it as their default today.
Do I still need X-Frame-Options?
The frame-ancestors setting in a Content-Security-Policy does the same job and takes priority in current browsers. X-Frame-Options still helps older browsers, so many sites send both.
Why not include a Content-Security-Policy here?
It is long and specific to your site, so it has its own builder, along with an evaluator that checks one you already have. The same goes for the Permissions-Policy.