HTTP Security Headers Generator
Generate a complete HTTP security headers config with CSP, HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Export to nginx, Apache, Express, Caddy, and Cloudflare Pages — 100% in-browser.
Loading tool...
What is HTTP Security Headers Generator?
The HTTP Security Headers Generator is a free online tool that builds a complete set of browser security headers — Content Security Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin isolation headers (COOP, CORP, COEP). Start from a curated preset, tweak each header value, and export a ready-to-deploy configuration for nginx, Apache, Express/Helmet, Caddy, or Cloudflare Pages. Everything runs 100% in your browser.
Key Benefits
- Curated presets (Strict, Balanced, Development, API) instead of writing CSP from scratch
- Five export formats: nginx, Apache, Express/Helmet, Caddy, and Cloudflare Pages _headers
- Toggle and edit each header individually with a live config preview
- Follows OWASP and Mozilla Observatory best practices by default
- 100% client-side — no data leaves your browser, safe for internal use
Common Use Cases
- •DevOps engineers hardening a new deployment before it goes live
- •Developers adding Helmet or equivalent security headers to a Node.js app
- •Site reliability teams scoring A+ on Mozilla Observatory and SSL Labs
- •Platform teams shipping Cloudflare Pages or Caddy configs with correct headers
- •Security auditors generating a baseline config to compare against production
How to Use the HTTP Security Headers Generator
- Pick a preset: Start from Strict, Balanced, Development, or API/JSON preset to get a sensible baseline set of headers.
- Toggle and edit headers: Enable or disable individual headers like CSP, HSTS, and Referrer-Policy, and edit each value inline to fit your site.
- Choose an output format: Select nginx, Apache .htaccess, Express, Caddy, Cloudflare Pages _headers, or raw HTTP to match your server.
- Copy or download: Copy the generated config to your clipboard or download it as a ready-to-use file, then paste it into your server config.
Key Features
- Nine headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP
- Four ready-made presets: Strict, Balanced, Development, and API/JSON
- Six output formats: nginx, Apache .htaccess, Express, Caddy, Cloudflare Pages _headers, and raw HTTP
- Toggle each header on/off and edit values inline with a live preview
- Copy to clipboard or download the generated config file
- 100% in-browser — no server, no upload, no tracking