Home / Web & SEO / Security Headers Generator
Security Headers Generator
Build a Content Security Policy, HSTS and other security headers, graded, for Nginx, Apache, Netlify, Vercel and more.
Free, no uploads, no sign-up. Runs 100% in your browser.
How Security Headers Generator works
Generated in your browser from what you type or drop. Nothing is fetched from or sent to your site. Start in report-only mode to test the policy without breaking your site.
Input: Settings. Output: Config.
How to use Security Headers Generator
- Set CSP sources.
- Choose HSTS, framing and referrer options.
- Pick your server and copy.
Tips
- Nothing is fetched from your site, so these tools also work for staging sites and pages behind a login.
- Test changes on a staging copy of your site first.
Security Headers Generator FAQ
- Are my files uploaded?
- No. This tool runs entirely in your browser tab. Files are read from your disk into memory and the result is generated locally.
- Is it free? Are there limits or watermarks?
- Free and open source (MIT). There are no file-size caps, daily quotas, accounts or watermarks.
- Does it work offline?
- Yes, once the page (and any engine it needs) has loaded, it keeps working without a connection thanks to the service worker cache.
Related tools
- security.txt Generator: Make a security.txt file (RFC 9116) so researchers know how to report problems with your site.
- Redirect Rules Generator: Turn a list of old and new URLs into redirect rules for Apache, Nginx, Netlify, Vercel, Cloudflare, IIS or Caddy.
- robots.txt Generator & Tester: Build a robots.txt with rule groups and sitemaps, block AI crawlers in one tick, and test which URLs are allowed.
- Schema Markup Generator: Make JSON-LD structured data for FAQ, Article, Product, Local Business, Event, Recipe, How-to and more.