Security Headers Generator

Security headers are HTTP response headers that instruct browsers how to behave when handling your site's content, providing additional protection against common web attacks. Key security headers include Content-Security-Policy (XSS protection), Strict-Transport-Security (HTTPS enforcement), X-Content-Type-Options (MIME sniffing prevention), X-Frame-Options (clickjacking prevention), Referrer-Policy (referrer information control), and Permissions-Policy (browser feature access restrictions).

In Apache, use the Header directive in .htaccess or your virtual host config: Header always set X-Content-Type-Options "nosniff". In Nginx, use the add_header directive in your server or location block: add_header X-Content-Type-Options "nosniff" always. The always keyword ensures the header is sent even for error responses. After adding headers, reload your web server configuration and verify using a browser's developer tools or a header checker tool.

X-Frame-Options prevents your page from being embedded in an <iframe> on another domain, protecting against clickjacking attacks. Values are DENY (never allow framing) or SAMEORIGIN (only allow framing by same-origin pages). It is largely superseded by the frame-ancestors directive in Content-Security-Policy, which is more flexible and powerful. However, for broader browser compatibility (especially older browsers), it is still recommended to set both X-Frame-Options and a frame-ancestors CSP directive.

Referrer-Policy controls how much referrer information (the URL of the page the user came from) is included in HTTP requests. no-referrer sends no referrer information at all. strict-origin-when-cross-origin (the recommended default) sends the full URL for same-origin requests, but only the origin (no path) for cross-origin requests, and nothing when downgrading from HTTPS to HTTP. no-referrer-when-downgrade is a common older default. strict-origin-when-cross-origin balances privacy and analytics needs.