Toggle HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy. Exports Cloudflare, nginx, and Apache config.
Builds HTTP security header configurations with correct syntax for common web server and platform options: Nginx, Apache, Cloudflare, and generic header format. Configure values through a form interface and get copy-paste ready output.
Covers the most security-relevant HTTP response headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Incorrect header syntax is a common reason security headers fail silently. An HSTS header missing the required max-age directive provides no protection. A CSP with a syntax error may be ignored by the browser entirely.
This tool generates syntactically correct header values so you can focus on the policy decisions rather than the formatting. Test the output with the Security Headers Checker tool to validate the headers are being served as expected.