Developer tools 100% free

Security headers generator

Tick the headers, enter the external domains the site uses (fonts, analytics, videos) and copy the configuration for your server.

How to use

Back to SEO and publishing

Your site's security headers

Server

HSTS (Strict-Transport-Security, 1 year) Include subdomains in HSTS X-Content-Type-Options: nosniff Block the site inside other sites’ iframes Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy (block camera, microphone and location) Content-Security-Policy Report-only CSP (Report-Only), to test first

Script domains

Style domains

Font domains

Image domains

Connections (fetch, analytics)

Allowed iframes (videos, maps)

Allow inline scripts and styles ('unsafe-inline'), if the site uses them

Available in:

Security headers generator: what it is for

Tick the headers and enter the external domains the site uses for scripts, styles, fonts, images, connections and iframes. The tool builds the Content-Security-Policy with 'self', frame-ancestors, base-uri, form-action and object-src 'none', with a report-only option to test before blocking.

The configuration comes ready for Nginx (add_header always), Apache (.htaccess), the _headers file for Netlify and Cloudflare Pages, or vercel.json.

How to use

Choose the server and tick the headers.
Enter the external domains the site uses.
Copy the configuration and test with the browser console open.

When to use it

Hardening static websites.
Protecting the site against clickjacking.
Preparing a site's CSP before turning on blocking.

Frequently asked questions

What are these headers for?

They tell the browser how to protect itself: only use HTTPS (HSTS), do not guess file types (nosniff), do not let the site be opened inside another site (against clickjacking), limit what goes in the Referer and block camera, microphone and location the site does not use.

Can Content-Security-Policy break the site?

It can, if a domain the site uses is missing (Google Fonts, Analytics, YouTube, CDN). Start with report-only mode (Report-Only), open the site with the browser console open, add the domains that show up as blocked and only then switch to blocking mode.

Should I be careful with HSTS?

Yes: once the browser receives HSTS, it only accesses the domain over HTTPS for the max-age period. Turn it on only when HTTPS works across the whole domain, and only include subdomains if all of them have HTTPS.

How do I check it worked?

Open the site, go to Developer Tools, Network tab, click the page and look at the response headers. There are also online security header checkers.

Is it really free?

Yes, 100% free. No sign-up, no subscription and no usage limits. All Tools123 tools are free and run right in your browser.

Similar tools

The tools are provided as is, without warranty. We are not responsible for the results or for how they are used.