Security Headers Generator
Answer a few questions about your site and get security header config snippets for common web servers.
About the security headers generator
This generator turns the choice of which HTTP security headers to enable into ready-to-paste configuration for your actual server software, rather than leaving you to translate a general recommendation into nginx, Apache or Caddy syntax yourself, which is where small mistakes such as a missing semicolon commonly creep in. For Content-Security-Policy specifically, it walks through the resource types your page actually loads from, script-src, style-src, img-src and so on, and builds a policy from what you select rather than a generic template, since a CSP copied from an unrelated site is a common cause of an over-broad policy or one that unexpectedly breaks the page.
It also generates Strict-Transport-Security with a sensible max-age and includeSubDomains, X-Content-Type-Options, and a Referrer-Policy choice with a short explanation of the trade-off between privacy and how much referrer information downstream sites still receive from your outbound links. Because CSP is easy to get wrong on the first attempt, the generated snippet defaults to Content-Security-Policy-Report-Only where the server platform supports it, so you can deploy it, watch for violation reports, and switch to the enforcing header only once you have confirmed nothing legitimate is being blocked.
Applying the generated snippet is only the first step; re-running a security headers check against the live site afterward confirms the headers actually reached the response as configured, since a reverse proxy or CDN in front of the server can sometimes strip or override headers set at the origin. That verification step matters because a header set correctly at the origin server is not guaranteed to survive unmodified once it passes through every layer of infrastructure in front of it.
Common questions
- Which servers are supported?
- Ready-made configuration snippets are generated for nginx, Apache and Caddy, covering the header syntax each one expects.
- Will the generated CSP be too strict?
- It is built from the resource types you tell it your page actually loads, and defaults to Report-Only mode where supported, so you can check for violations before switching to full enforcement.
- What does includeSubDomains do on HSTS?
- It extends the HTTPS-only instruction to every subdomain, not just the exact host, which is stronger but should only be enabled once every subdomain is confirmed to actually serve HTTPS.
- Do I need to restart my server after applying the snippet?
- Most web servers need a reload or restart to pick up a configuration file change; the exact command depends on your platform and is noted alongside the generated snippet.