consolelog.tools

Security Headers Generator

Generate hardened HTTP security headers for nginx, Apache, Caddy, Vercel, Netlify, Next.js, Express, or Cloudflare — with a live security grade as you configure them. Or switch to Audit mode to paste a site's response headers and get a graded report with fixes.

About this ToolHow it works, benefits & use cases

A two-in-one HTTP security headers tool. In Build mode you configure a hardened set of response headers — Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin-Opener/Embedder/Resource policies — and watch a live security grade update as you toggle each one, using the same severity-weighted scoring that scanners like securityheaders.com apply. Start from a preset (Strict, Balanced, API/JSON, or Relaxed) and fine-tune with contextual editors: an HSTS builder with max-age, includeSubDomains, and preload; dropdowns for Referrer-Policy and X-Frame-Options; and a click-to-lock Permissions-Policy feature picker. Then copy ready-to-paste config for nine platforms — nginx add_header directives, an Apache mod_headers block, a Caddyfile, vercel.json, a Netlify _headers file, a Next.js headers() function, Express middleware, a Cloudflare Worker, or raw HTTP. In Audit mode you paste the response headers from any site and get a graded report with per-header status, severity, and concrete fixes. Everything runs in your browser and the full configuration is captured in the URL so you can share it.

How to Use

  1. 1In Build mode, pick a preset (Strict, Balanced, API/JSON, or Relaxed) as your starting point.
  2. 2Toggle individual headers on or off and tune their values with the contextual editors (HSTS max-age, Referrer-Policy, Permissions-Policy features, and more).
  3. 3Watch the live security grade update, then choose your platform (nginx, Apache, Caddy, Vercel, Netlify, Next.js, Express, or Cloudflare).
  4. 4Copy or download the generated config and drop it into your server or config file.
  5. 5Switch to Audit mode to paste an existing site's response headers and get a graded report with fixes.

Key Benefits

  • Live A+ to F security grade that mirrors how scanners score your site
  • Four presets (Strict, Balanced, API/JSON, Relaxed) plus per-header fine-tuning
  • Copy-paste config for nine platforms from one configuration
  • Contextual editors: HSTS builder, Permissions-Policy feature locks, policy dropdowns
  • Audit mode grades any site's existing headers and explains every gap
  • Runs entirely in the browser — no headers or URLs are sent anywhere

Common Use Cases

  • Hardening a new site to an A+ grade before launch
  • Generating nginx, Apache, or Caddy header config without memorizing directive syntax
  • Adding security headers to a Vercel, Netlify, or Next.js deployment
  • Auditing a production site's response headers and prioritizing fixes by severity
  • Locking down browser features (camera, microphone, geolocation) via Permissions-Policy
Security gradeA
8
Present
2
Missing
0
Warnings

Drop into security-headers.conf

# Security headers — paste inside your server { } (or http { }) block.
# `always` ensures the header is sent on error responses too.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;

Preset

Headers

Strict-Transport-Securityhigh

Forces HTTPS connections and prevents protocol downgrade attacks

Content-Security-Policycritical

Prevents XSS attacks by controlling which resources can be loaded

Need a richer policy with nonces, hashes, and per-directive sources? Build it in the CSP Generator and paste it here.

X-Frame-Optionshigh

Prevents clickjacking attacks by controlling iframe embedding

X-Content-Type-Optionsmedium

Prevents MIME-sniffing attacks

Fixed value nosniff — the only valid setting.

Referrer-Policymedium

Controls how much referrer information is sent

Permissions-Policymedium

Controls which browser features can be used

Lock these features to no origins:
Cross-Origin-Opener-Policylow

Isolates browsing context to prevent cross-origin attacks

Cross-Origin-Embedder-Policylow

Prevents documents from loading cross-origin resources

Cross-Origin-Resource-Policylow

Prevents other origins from reading the resource

X-XSS-Protectionlow

Legacy XSS protection (deprecated, use CSP instead)

Graded the way scanners grade you

The grade updates live using the same severity-weighted scoring that security scanners apply, so you can dial in an A+ before you deploy. Critical and high-severity headers (CSP, HSTS, X-Frame-Options) move the needle most.

One config, nine platforms

Pick your stack and copy ready-to-paste config — nginx add_header, an Apache mod_headers block, a Caddyfile, a vercel.json, a Netlify _headers file, a Next.js headers() function, Express middleware, or a Cloudflare Worker.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on Twitter

Related tools