DevBolt
Processed in your browser. Your data never leaves your device.

How do I generate HTTP security headers?

Toggle 12 security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and more) using visual controls. Choose a preset (Strict, Moderate, Basic, API, Next.js, WordPress) and export as raw headers, Nginx, Apache, Vercel, Netlify, or Cloudflare config. See a security grade (A+ to F). Everything runs in your browser.

Generate strict security headers
Input
Preset: Strict
Output: Nginx
Output
# Security Headers — Strict
add_header Strict-Transport-Security
  "max-age=63072000; includeSubDomains;
  preload" always;
add_header X-Content-Type-Options
  "nosniff" always;
add_header X-Frame-Options
  "DENY" always;
add_header Referrer-Policy
  "strict-origin-when-cross-origin";
add_header Permissions-Policy
  "camera=(), microphone=(),
  geolocation=()";

Security Score: A+

Security Headers Generator

Generate and analyze HTTP security headers for Nginx, Apache, Vercel, Netlify, and Cloudflare. Visual builder with presets and security scoring.

Strict-Transport-Security (HSTS)

Critical

X-Content-Type-Options

High

Always set to nosniff — no configuration needed.

X-Frame-Options

High

Referrer-Policy

Medium

Permissions-Policy

Medium
Camera
Microphone
Geolocation
Payment
USB
Gyroscope
Magnetometer
Accelerometer
Autoplay
Fullscreen

Content-Security-Policy

Critical

Cross-Origin-Opener-Policy

Medium

Cross-Origin-Embedder-Policy

Medium

Cross-Origin-Resource-Policy

Medium

X-XSS-Protection

Low

Set to 0 to disable the legacy XSS auditor (modern best practice). Use CSP instead.

X-DNS-Prefetch-Control

Low

X-Permitted-Cross-Domain-Policies

Low

Security Score

C
6 headers enabled68/100
ℹ X-Frame-Options: DENY — page cannot be embedded in any iframe
⚠ Content-Security-Policy not set — no protection against XSS and injection attacks. Use the CSP Header Builder for detailed configuration.

Output Format

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), gyroscope=(), magnetometer=(), accelerometer=(), autoplay=(), fullscreen=(self)
X-XSS-Protection: 0
6
Headers
C
Grade
347
Bytes

Related Guides

HSTS Guide

How Strict-Transport-Security works, preload lists, and deployment best practices.

Security Headers Explained

Complete guide to every HTTP security header and when to use each one.

Security Headers Checker

How to audit your site's security headers and fix common issues.

Tips & Best Practices

Pro Tip

Start with Strict-Transport-Security and Content-Type-Options

HSTS (Strict-Transport-Security: max-age=63072000; includeSubDomains) forces HTTPS and prevents SSL stripping attacks. X-Content-Type-Options: nosniff prevents browsers from MIME-sniffing responses as executable scripts. These two headers are the highest impact and lowest risk to add.

Common Pitfall

Don't set HSTS includeSubDomains if you have HTTP-only subdomains

HSTS with includeSubDomains forces HTTPS on every subdomain. If staging.example.com or internal.example.com uses plain HTTP, those sites become unreachable. Start with the main domain only, verify all subdomains support HTTPS, then add includeSubDomains.

Real-World Example

Test your headers with SecurityHeaders.com before deploying

Configure your headers in DevBolt's generator, deploy them to staging, then scan with securityheaders.com to verify they're applied correctly. Many headers are silently ignored if the syntax is wrong. A B+ grade or higher indicates solid security posture.

Security Note

Permissions-Policy replaces the deprecated Feature-Policy

Permissions-Policy: camera=(), microphone=(), geolocation=() blocks your site (and embedded iframes) from accessing sensitive device APIs. Even if your app doesn't use these features, blocking them prevents any injected third-party script from silently activating the camera or microphone.

Frequently Asked Questions

What HTTP security headers should every website have?
Every website should set: Content-Security-Policy (CSP) to control allowed resources and prevent XSS, Strict-Transport-Security (HSTS) to force HTTPS, X-Content-Type-Options: nosniff to prevent MIME sniffing, X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking, Referrer-Policy to control URL information sent to other sites, and Permissions-Policy to disable unused browser features. These add defense-in-depth layers that protect users even if application code has vulnerabilities. DevBolt generates correctly formatted configurations for your platform.
How do I configure Content-Security-Policy headers?
CSP whitelists allowed content sources per resource type. Start with default-src 'self' allowing only your domain. Add script-src for JavaScript, style-src for CSS, img-src for images, connect-src for APIs, and font-src for fonts. Use report-uri or report-to to receive violation reports during rollout. DevBolt builds the policy from your selected directives and outputs server-specific configuration for Nginx, Apache, Vercel, Netlify, or Cloudflare.
What is the difference between security header configs for Nginx, Apache, and Vercel?
Nginx uses add_header directives in server blocks. Apache uses Header set directives in .htaccess requiring mod_headers. Vercel uses a headers array in vercel.json. Cloudflare uses Transform Rules or a _headers file. The actual header names and values are identical — only the configuration syntax differs. DevBolt outputs the exact format for your chosen platform so you can copy it directly.

Related Generate Tools

NGX

Nginx Config Generator

Generate nginx configuration files — server blocks, SSL, reverse proxy, gzip, load balancing, and security headers

Aa

ASCII Art Text Generator

Convert text into ASCII art with 7 font styles — banner, block, shadow, slim, star, dot, lines — with comment wrapping for code

R.*

Regex Generator

Generate regex patterns by describing what you need — 60+ curated patterns, visual composer, live tester, and pattern explanations

GIT

Git Command Builder

Build git commands visually with an interactive builder — branching, merging, rebasing, stashing, tags, and 80+ cheat sheet entries