01
Start with the conservative draft
The balanced preset uses strict-origin-when-cross-origin and self for three browser features; switching presets keeps your separate HSTS and CORS settings.
- A preset is a starting point, never a safety grade.
Web security settings
Security Headers Generatordraft policies you can inspect
Choose a policy draft, inspect every emitted header, and review the deployment warnings before copying.
Security Headers Generator
Preset: Balanced draft
Referrer-Policy: Strict origin when cross origin
Permissions-Policy: Camera · Self (self) / Microphone · Self (self) / Geolocation · Self (self)
HSTS: Omit
CORS example: Omit
Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(self), microphone=(self), geolocation=(self)
Policy values stay in this browser. No request is sent to your origin.
Options
Permissions-Policy
HSTS
HSTS works on HTTPS responses. Test a short max-age first; preload requires at least one year and all subdomains on HTTPS.
CORS example
Use * only without credentials, or enter one exact http(s) origin with no path. This is a response example, not an authorization rule.
Header explanations
Referrer-Policy: strict-origin-when-cross-originThe selected policy controls which Referer details a browser sends.
Permissions-Policy: camera=(self), microphone=(self), geolocation=(self)An empty allowlist blocks a feature; self keeps it on the same origin.
Warnings
No warnings for the selected draft.
2 headers ready · 0 warnings
When an API needs a CORS response and the main site needs a referral policy, copying a generic security snippet makes it hard to see which header does what. This Security Headers Generator keeps those choices separate.
An HTTP security headers draft here is plain response text. It does not inspect your live server, enable HTTPS, or prove that a policy suits every page.
Why use this Security Headers Generator
Every generated line stays visible with the decision that produced it.
Policies stay separate
The Security Headers Generator shows Referrer-Policy and three Permissions-Policy features as individual choices; a privacy preset blocks those features without silently switching on HSTS.
High-impact switches start off
HSTS and the CORS headers are opt-in. A short HSTS trial and a precise CORS origin make risky changes obvious before you move a draft to a server.
From policy choices to a reviewable response
02
Test the risky switches
HSTS begins at 300 seconds and stays off until enabled. Preload requires a year and includeSubDomains; wildcard CORS cannot be combined with credentials.
- The preload word does not enroll a domain in a browser list.
03
Export only the current result
Auto generation waits 350 ms after changes. Turn it off for Ctrl/Cmd+Enter; a changed field disables copying and downloading until you regenerate.
- Example and clear show a preview, then allow one undo.
Four focused response-header controls
Referrer policy choice
Select one of four policies, including no-referrer; the output states the exact Referrer-Policy value rather than promising universal privacy.
Browser feature limits
Set camera, microphone and geolocation to self or none independently in Permissions-Policy.
Optional transport and CORS
Add Strict-Transport-Security and a CORS origin example only when their separate switches are on.
What the draft can and cannot establish
- No universal production preset
- This Security Headers Generator cannot know your certificates, subdomains, embeds or application code; a balanced draft is not a security score.
- HSTS affects future visits
- Browsers remember HSTS after a valid HTTPS response. Start with a short max-age; includeSubDomains can lock out an unprepared subdomain.
- CORS is not authentication
- A specific origin example controls browser access to responses. It does not authorize callers, prevent CSRF or verify the deployed server response.
Security Headers Generator FAQ
What does the preload flag on HSTS do?
The preload token is an eligibility signal; you must separately submit the domain, and removing it later can take time. This generator enforces the one-year max-age and includeSubDomains prerequisites.
What is the difference between the 'self', '*', and 'none' policies?
In Permissions-Policy, self allows the current origin and none uses an empty allowlist. This page intentionally omits the unrestricted * option, which would allow more contexts.
Should security headers/policies be set in nginx or express?
Copy the raw header lines into the response configuration you actually maintain, whether that is Nginx or Express. This page does not generate platform-specific syntax or test precedence.
Is the generated Content-Security-Policy production-ready?
No CSP is generated here. A production CSP needs an inventory of your scripts and resources; the four policies here cannot infer it.
Does this tool send my configuration anywhere?
No. The Security Headers Generator runs in this browser, sends no request to your site, and does not store a draft on a server.
Something looks wrong?
Try the Security Headers Generator now
Adjust one policy, read its explanation and copy only after the result is current.