Security Headers Generator
Build the exact HSTS, CSP, Referrer-Policy and Permissions-Policy config for nginx, Caddy, Netlify, Next.js or Apache — and get warned about the settings that break a live site.
83.7% of the 104 live sites we audited fail the security-headers check. Pick what you want, get the exact config for your server.
How to use
Tick the headers you want, pick your policy presets, then choose the server syntax. The generator prints a ready-to-paste config block for that specific server, plus a list of rollout traps above the output: a CSP that will blank the page, a preload flag that is effectively irreversible, a max-age the preload list ignores. Read the warnings, paste the config.
FAQ
We audited 104 live websites and 83.7% of them were missing security headers entirely, so this is the single cheapest score to fix. The output is not generic advice: nginx gets add_header with the always flag on every line, because a location block that sets its own headers silently drops the inherited ones; Netlify and Cloudflare Pages get the _headers format with the blank line that the parser needs; Next.js gets the headers() object with real JSON quoting. X-Frame-Options is flagged as superseded by frame-ancestors so you know why keeping both is only for old browsers, and Report-Only mode says out loud that it blocks nothing.
Privacy: every calculation runs inside your browser. Your files and text never leave your device.