SEOlust logo SEOlust
Security & Privacy

Security Headers Generator

Build hardened HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP starter) and copy them as Apache or Nginx config. Runs in your browser. Free.

All tools
Force HTTPS. Set max-age (seconds):
Block clickjacking via framing:
Stop MIME-type sniffing.
Control what referrer is sent:
Disable powerful features you don't use:
A safe baseline you can tighten later.
Raw headers
Apache
Nginx

💡 How to use

  • Toggle the security headers you want and copy the config for raw headers, Apache, or Nginx.
  • HSTS forces HTTPS, X-Frame-Options blocks clickjacking, nosniff stops MIME attacks, and Permissions-Policy disables features you don't use.
  • Test the CSP starter carefully before enforcing it. Runs entirely in your browser.

Free Security Headers Generator (HSTS, CSP, X-Frame-Options)

Generate the recommended HTTP security headers for your site in one click. Toggle HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a Content-Security-Policy starter, then copy ready-to-paste config for raw headers, Apache, or Nginx. Free, no sign-up, runs in your browser.

What this tool does

HTTP security headers are one of the highest-impact, lowest-effort ways to harden a website — they tell the browser to enforce HTTPS, block clickjacking, stop MIME sniffing, and limit what pages can do. This generator lets you pick the headers you want, configure their options, and copy the exact lines for your server, so you can add strong defaults without memorising the syntax.

How to use it

It is instant:

  • Toggle the security headers you want to enable.
  • Adjust options like HSTS max-age or which features to disable.
  • Switch between raw headers, Apache, and Nginx output.
  • Copy the config into your server or CDN.

The headers explained

<strong>Strict-Transport-Security (HSTS)</strong> forces browsers to use HTTPS. <strong>X-Frame-Options</strong> stops your pages being framed by other sites (clickjacking). <strong>X-Content-Type-Options: nosniff</strong> prevents the browser guessing content types. <strong>Referrer-Policy</strong> controls how much referrer information leaks to other sites. <strong>Permissions-Policy</strong> disables powerful features like camera, microphone, and geolocation when you don't use them. <strong>Content-Security-Policy</strong> restricts where scripts and resources can load from.

Apache, Nginx, or raw

The tool outputs the same headers in three formats. <strong>Raw headers</strong> are handy for CDNs and edge config. <strong>Apache</strong> uses <code>Header always set</code> directives for an <code>.htaccess</code> or vhost. <strong>Nginx</strong> uses <code>add_header ... always;</code> inside a server or location block. Pick the one that matches your stack and paste it in.

Roll out safely

Most of these headers are safe to enable immediately. Two need care: turn on HSTS <code>preload</code> only once you're certain every subdomain will always serve HTTPS, because it's hard to undo; and test the Content-Security-Policy starter thoroughly (ideally in report-only mode first) since a strict policy can block legitimate scripts. Use our Security Headers Checker afterwards to confirm they're live.

Privacy

The config is generated entirely in your browser from your selections — nothing is uploaded, logged, or stored. You can prepare headers for private or internal sites without any details leaving your device.

FAQ

Is this security headers generator free?
Yes. It is completely free, runs in your browser, and needs no account or sign-up.
Which security headers should I add?
At minimum: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Add Permissions-Policy and a Content-Security-Policy for stronger protection.
What does HSTS do?
Strict-Transport-Security tells browsers to only connect to your site over HTTPS, preventing downgrade and cookie-hijacking attacks. Enable 'preload' only when every subdomain is HTTPS-ready.
Can I use these on Apache and Nginx?
Yes. The tool outputs ready-to-paste config for raw headers, Apache (Header always set), and Nginx (add_header ... always).
Is the CSP starter safe to enable?
It's a conservative baseline, but any CSP can block legitimate resources. Test it — ideally with Content-Security-Policy-Report-Only first — before enforcing.
Are my settings uploaded?
No. The config is generated locally in your browser, so your settings never leave your device.
How do I verify the headers are working?
After deploying, use our Security Headers Checker to confirm each header is present and correctly configured.

Related tools

Pro tip: pair this tool with Robots.txt Exposure Checker and Cookie Security Checker for a faster SEO workflow.