Grátis · Redes e infraestrutura de TI

Gerador de cabeçalhos de segurança HTTP.

Crie Content-Security-Policy, HSTS, Referrer-Policy, Permissions-Policy e cabeçalhos cross-origin para Nginx, Apache, Caddy, IIS, _headers e Express.

CALCULATED IN YOUR BROWSER · NOTHING IS UPLOADED

Server

Strict-Transport-Security (HSTS)

Send HSTS (HTTPS sites only)

max-age

includeSubDomains

preload (submit to hstspreload.org)

Content-Security-Policy

Send a Content-Security-Policy

Mode

Extra script sources

Extra style sources

Allow inline styles ('unsafe-inline' in style-src)

Extra image sources

Extra font sources

Extra connect sources (fetch, XHR, WebSocket)

Frame sources (embedded content)

Who may embed this site (frame-ancestors)

upgrade-insecure-requests

Violation report URL (optional)

Other headers

X-Content-Type-Options: nosniff

Referrer-Policy

Permissions-Policy: disable camera, microphone, geolocation, payment, USB

Cross-Origin-Opener-Policy

Cross-Origin-Resource-Policy

X-Frame-Options (legacy browsers)

Headers7

Report-only mode does not block anything. Watch the browser console or reports, then switch to Enforce.

Configuration

# Inside the server { } block. A location that has its own add_header does not inherit these.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header X-Frame-Options "DENY" always;
server_tokens off;

Headers sent

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
Content-Security-Policy-Report-Only	default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
X-Content-Type-Options	nosniff
Referrer-Policy	strict-origin-when-cross-origin
Permissions-Policy	camera=(), microphone=(), geolocation=(), payment=(), usb=()
Cross-Origin-Opener-Policy	same-origin
X-Frame-Options	DENY

Test the site after deploying: a strict CSP can block scripts, fonts or embeds you rely on. The browser console names each blocked resource.
Only send HSTS on HTTPS responses; browsers ignore it over plain HTTP.

Como usar esta ferramenta: Gerador de cabeçalhos de segurança HTTP

Insira os dados ou escolha o arquivo. Ajuste as opções, gere o resultado e confira antes de copiar ou baixar.

Limites e formatos aceitos

Seus dados são processados no seu dispositivo.

Notas técnicas em inglês

CSP sources are validated for syntax, not reachability. Test the site after deploying; a strict policy can block resources you rely on. Everything is calculated in your browser; nothing is sent or probed on the network.

Selected options are assembled into header values, CSP keywords are quoted automatically, and the list is written in each server’s syntax with the escaping it needs.

HSTS for one year, a report-only CSP, nosniff, strict-origin-when-cross-origin and disabled camera/microphone produce seven headers ready for Nginx.