Gratuit · Réseau et infrastructure IT
Générateur d’en-têtes de sécurité HTTP.
Créez Content-Security-Policy, HSTS, Referrer-Policy, Permissions-Policy et en-têtes cross-origin pour Nginx, Apache, Caddy, IIS, _headers et Express.
Strict-Transport-Security (HSTS)
Content-Security-Policy
Other headers
Report-only mode does not block anything. Watch the browser console or reports, then switch to Enforce.
Configuration
# Inside the server { } block. A location that has its own add_header does not inherit these.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header X-Frame-Options "DENY" always;
server_tokens off;Headers sent
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| Content-Security-Policy-Report-Only | default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=() |
| Cross-Origin-Opener-Policy | same-origin |
| X-Frame-Options | DENY |
- Test the site after deploying: a strict CSP can block scripts, fonts or embeds you rely on. The browser console names each blocked resource.
- Only send HSTS on HTTPS responses; browsers ignore it over plain HTTP.
Comment utiliser cet outil: Générateur d’en-têtes de sécurité HTTP
Saisissez ou sélectionnez vos données. Réglez les options, générez le résultat puis vérifiez-le avant de le copier ou de le télécharger.
Limites et formats acceptés
Vos données sont traitées sur votre appareil.
Notes techniques en anglais
CSP sources are validated for syntax, not reachability. Test the site after deploying; a strict policy can block resources you rely on. Everything is calculated in your browser; nothing is sent or probed on the network.
Selected options are assembled into header values, CSP keywords are quoted automatically, and the list is written in each server’s syntax with the escaping it needs.
HSTS for one year, a report-only CSP, nosniff, strict-origin-when-cross-origin and disabled camera/microphone produce seven headers ready for Nginx.