Gratis · Redes e infraestructura TI
Generador de cabeceras de seguridad HTTP.
Cree Content-Security-Policy, HSTS, Referrer-Policy, Permissions-Policy y cabeceras cross-origin para Nginx, Apache, Caddy, IIS, _headers y Express.
Strict-Transport-Security (HSTS)
Content-Security-Policy
Other headers
Report-only mode does not block anything. Watch the browser console or reports, then switch to Enforce.
Configuration
# Inside the server { } block. A location that has its own add_header does not inherit these.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header X-Frame-Options "DENY" always;
server_tokens off;Headers sent
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| Content-Security-Policy-Report-Only | default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=() |
| Cross-Origin-Opener-Policy | same-origin |
| X-Frame-Options | DENY |
- Test the site after deploying: a strict CSP can block scripts, fonts or embeds you rely on. The browser console names each blocked resource.
- Only send HSTS on HTTPS responses; browsers ignore it over plain HTTP.
Cómo usar esta herramienta: Generador de cabeceras de seguridad HTTP
Introduce los datos o selecciona el archivo. Ajusta las opciones, genera el resultado y revísalo antes de copiarlo o descargarlo.
Límites y formatos compatibles
Los datos se procesan en tu dispositivo.
Notas técnicas en inglés
CSP sources are validated for syntax, not reachability. Test the site after deploying; a strict policy can block resources you rely on. Everything is calculated in your browser; nothing is sent or probed on the network.
Selected options are assembled into header values, CSP keywords are quoted automatically, and the list is written in each server’s syntax with the escaping it needs.
HSTS for one year, a report-only CSP, nosniff, strict-origin-when-cross-origin and disabled camera/microphone produce seven headers ready for Nginx.