Kostenlos · Netzwerk & IT-Infrastruktur

HTTP-Security-Header-Generator.

Erstellen Sie Content-Security-Policy, HSTS, Referrer-Policy, Permissions-Policy und Cross-Origin-Header für Nginx, Apache, Caddy, IIS, _headers und Express.

CALCULATED IN YOUR BROWSER · NOTHING IS UPLOADED

Server

Strict-Transport-Security (HSTS)

Send HSTS (HTTPS sites only)

max-age

includeSubDomains

preload (submit to hstspreload.org)

Content-Security-Policy

Send a Content-Security-Policy

Mode

Extra script sources

Extra style sources

Allow inline styles ('unsafe-inline' in style-src)

Extra image sources

Extra font sources

Extra connect sources (fetch, XHR, WebSocket)

Frame sources (embedded content)

Who may embed this site (frame-ancestors)

upgrade-insecure-requests

Violation report URL (optional)

Other headers

X-Content-Type-Options: nosniff

Referrer-Policy

Permissions-Policy: disable camera, microphone, geolocation, payment, USB

Cross-Origin-Opener-Policy

Cross-Origin-Resource-Policy

X-Frame-Options (legacy browsers)

Headers7

Report-only mode does not block anything. Watch the browser console or reports, then switch to Enforce.

Configuration

# Inside the server { } block. A location that has its own add_header does not inherit these.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header X-Frame-Options "DENY" always;
server_tokens off;

Headers sent

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
Content-Security-Policy-Report-Only	default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
X-Content-Type-Options	nosniff
Referrer-Policy	strict-origin-when-cross-origin
Permissions-Policy	camera=(), microphone=(), geolocation=(), payment=(), usb=()
Cross-Origin-Opener-Policy	same-origin
X-Frame-Options	DENY

Test the site after deploying: a strict CSP can block scripts, fonts or embeds you rely on. The browser console names each blocked resource.
Only send HSTS on HTTPS responses; browsers ignore it over plain HTTP.

So verwenden Sie das Tool: HTTP-Security-Header-Generator

Geben Sie Daten ein oder wählen Sie eine Datei. Passen Sie die Einstellungen an, erstellen Sie das Ergebnis und prüfen Sie es vor dem Kopieren oder Herunterladen.

Grenzen und unterstützte Formate

Ihre Eingaben werden auf Ihrem Gerät verarbeitet.

Technische Hinweise auf Englisch

CSP sources are validated for syntax, not reachability. Test the site after deploying; a strict policy can block resources you rely on. Everything is calculated in your browser; nothing is sent or probed on the network.

Selected options are assembled into header values, CSP keywords are quoted automatically, and the list is written in each server’s syntax with the escaping it needs.

HSTS for one year, a report-only CSP, nosniff, strict-origin-when-cross-origin and disabled camera/microphone produce seven headers ready for Nginx.