HTTP Security Response Headers Generator

1. Choose headers

nosniff – stops browsers guessing file types. Safe for every site.
Stops other sites showing your pages in a frame (clickjacking).
How much of your URL is sent to other sites when visitors click a link.
Turn off browser features your site does not use:
Only enable when the whole site works over HTTPS. Browsers cache this for the time you choose.
same-origin – isolates your pages from pop-ups. Can break “Sign in with…” and payment pop-ups; test first.
A loose starting policy. Tighten it step by step and watch the browser console for blocked items.

2. Your configuration

What security headers do

HTTP response headers are instructions your server sends with every page. Security headers tell the browser to switch on protections it would not use by default. They don’t fix bugs in your site, but they make whole classes of attacks harder: clickjacking, content-type confusion, leaking URLs to other sites and, with a Content Security Policy, many cross-site scripting (XSS) attacks.

The headers in this tool

  • X-Content-Type-Options: nosniff – the browser must trust the file type your server sends instead of guessing. No side effects.
  • X-Frame-Options – SAMEORIGIN lets only your own site frame your pages; DENY blocks all framing. The modern equivalent is the CSP rule frame-ancestors; sending both is fine.
  • Referrer-Policy – strict-origin-when-cross-origin (the default in modern browsers) sends only your domain, not the full URL, to other sites. Analytics still sees referrals.
  • Permissions-Policy – disables powerful browser features (camera, microphone, location…) for your pages and any embedded frames. Only turn off features your site does not use; for example, keep payment on if you use Google Pay or Apple Pay buttons.
  • Strict-Transport-Security (HSTS) – after the first visit, the browser refuses to load your site over plain HTTP. Start with a short max-age, check everything works, then raise it. Add preload only if you plan to submit the domain to the browser preload list, which is hard to undo.
  • Cross-Origin-Opener-Policy – stops pages opened from your site from accessing it, and the other way round. Test login and checkout pop-ups after enabling it.
  • Content-Security-Policy (CSP) – a list of where scripts, styles, images and fonts may load from. It is the strongest header and the easiest to get wrong, so start in Report-Only mode, open your site with the browser’s developer console, fix or allow every source it reports, and only then switch to enforce.

Checking the result

After adding the headers, reload your site and open the developer tools (F12) → Network → click the page → Headers to confirm they are sent. You can also check them with our Security Headers Checker. If something breaks, remove the last header you added.

Headers you can skip

X-XSS-Protection is obsolete: modern browsers have removed the feature it controlled, so it is not included. Expect-CT is also deprecated.