Home /Tools /Security Headers Config Generator

Security Headers Gen

Visually construct a robust set of HTTP security headers to protect your application from XSS, clickjacking, and other common attacks.

Target Environment

Header Configuration

X-Content-Type-Options

Prevents MIME-sniffing. Forces browsers to respect declared content types.

X-Frame-Options

Protects against clickjacking by restricting framing.

X-XSS-Protection

Legacy defense-in-depth against XSS. Less relevant with strong CSP.

Strict-Transport-Security

Forces HTTPS. Warning: Only enable if you have a valid, lasting SSL certificate.

includeSubDomains

preload

Referrer-Policy

Controls how much referrer info is passed along in requests.

Content-Security-Policy

Defines approved sources of content. Powerful XSS mitigation.

Permissions-Policy

Controls access to browser features (camera, mic, etc).

Server Configuration (apache)

"text-purple-400 font-bold">
  "text-indigo-400 font-bold">Header always set X-Content-Type-Options "nosniff"
  "text-indigo-400 font-bold">Header always set X-Frame-Options "SAMEORIGIN"
  "text-indigo-400 font-bold">Header always set X-XSS-Protection "1; mode=block"
  "text-indigo-400 font-bold">Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  "text-indigo-400 font-bold">Header always set Referrer-Policy "strict-origin-when-cross-origin"
  "text-indigo-400 font-bold">Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
  "text-indigo-400 font-bold">Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
"text-purple-400 font-bold">

Why are Security Headers Important?

HTTP security headers tell the browser how to behave when handling your website's content. They add a layer of security that helps mitigate attacks and security vulnerabilities, such as Cross-Site Scripting (XSS), Clickjacking, and packet sniffing.

Key Headers Explained:

Strict-Transport-Security (HSTS): Forces the browser to only connect to your site via HTTPS. Warning: Do not enable this if you do not have a working SSL certificate, or you will lock users out of your site.
Content-Security-Policy (CSP): The ultimate defense against XSS. It strictly defines which domains are allowed to load scripts, styles, images, and fonts. It can be complex to set up correctly.
X-Frame-Options: Prevents your site from being loaded inside an iframe on another domain, preventing Clickjacking.
X-Content-Type-Options: Stops the browser from trying to "guess" the MIME type of a file, forcing it to use the type declared by the server.
Permissions-Policy: Controls which browser features (like the camera, microphone, or geolocation) are allowed to be used by the page or embedded iframes.

Related Guides

Deepen your understanding with our expert articles.

The Complete Guide to HTTP Security HeadersRead guide →