Gratis · Netwerk en IT-infrastructuur

Generator voor HTTP-beveiligingsheaders.

Maak Content-Security-Policy, HSTS, Referrer-Policy, Permissions-Policy en cross-origin-headers voor Nginx, Apache, Caddy, IIS, _headers en Express.

CALCULATED IN YOUR BROWSER · NOTHING IS UPLOADED

Server

Strict-Transport-Security (HSTS)

Send HSTS (HTTPS sites only)

max-age

includeSubDomains

preload (submit to hstspreload.org)

Content-Security-Policy

Send a Content-Security-Policy

Mode

Extra script sources

Extra style sources

Allow inline styles ('unsafe-inline' in style-src)

Extra image sources

Extra font sources

Extra connect sources (fetch, XHR, WebSocket)

Frame sources (embedded content)

Who may embed this site (frame-ancestors)

upgrade-insecure-requests

Violation report URL (optional)

Other headers

X-Content-Type-Options: nosniff

Referrer-Policy

Permissions-Policy: disable camera, microphone, geolocation, payment, USB

Cross-Origin-Opener-Policy

Cross-Origin-Resource-Policy

X-Frame-Options (legacy browsers)

Headers7

Report-only mode does not block anything. Watch the browser console or reports, then switch to Enforce.

Configuration

# Inside the server { } block. A location that has its own add_header does not inherit these.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header X-Frame-Options "DENY" always;
server_tokens off;

Headers sent

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
Content-Security-Policy-Report-Only	default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
X-Content-Type-Options	nosniff
Referrer-Policy	strict-origin-when-cross-origin
Permissions-Policy	camera=(), microphone=(), geolocation=(), payment=(), usb=()
Cross-Origin-Opener-Policy	same-origin
X-Frame-Options	DENY

Test the site after deploying: a strict CSP can block scripts, fonts or embeds you rely on. The browser console names each blocked resource.
Only send HSTS on HTTPS responses; browsers ignore it over plain HTTP.

Zo gebruik je deze tool: Generator voor HTTP-beveiligingsheaders

Voer gegevens in of kies een bestand. Pas de instellingen aan, maak het resultaat en controleer het voordat je het kopieert of downloadt.

Limieten en ondersteunde formaten

Je invoer wordt op je apparaat verwerkt.

Technische opmerkingen in het Engels

CSP sources are validated for syntax, not reachability. Test the site after deploying; a strict policy can block resources you rely on. Everything is calculated in your browser; nothing is sent or probed on the network.

Selected options are assembled into header values, CSP keywords are quoted automatically, and the list is written in each server’s syntax with the escaping it needs.

HSTS for one year, a report-only CSP, nosniff, strict-origin-when-cross-origin and disabled camera/microphone produce seven headers ready for Nginx.