Security Header Generator

Generate recommended security header configurations for your web server.

Options

Enforce HTTPS (HSTS)Tells browsers to always use the encrypted connection, even on the first visit after this one.Strict-Transport-Security

Max age (seconds)

Include subdomainsincludeSubDomains

Block framing (clickjacking protection)Stops other sites embedding your pages in hidden frames to trick visitors into clicking.X-Frame-Options: SAMEORIGINPrevent MIME-type sniffingStops browsers guessing file types, which can turn harmless uploads into executable code.X-Content-Type-Options: nosniffBasic XSS protectionsEnables the legacy browser filter against reflected cross-site scripting.X-XSS-Protection: 1; mode=block

Generated in your browser — copy the block into your server configuration.Verbose outputi

Configuration

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;

What these headers do

Security headers are one-line instructions your server sends with every response. HSTS (Strict-Transport-Security) tells browsers to insist on HTTPS; X-Frame-Options stops other sites framing your pages; X-Content-Type-Options stops browsers guessing file types. Together they close off a family of common attacks at almost no cost.

Common issues

HSTS with a tiny max-age — values under a few months give little protection; a year (31536000 seconds) is the widely used setting.
includeSubDomains surprises — it applies HSTS to every subdomain, so check that all of them serve HTTPS first.
Headers set in one place but stripped in another — CDNs and proxies sometimes overwrite origin headers.

How to check your work

After deploying, run your domain through the TLS tester — it reads the headers straight off your live site — or inspect the raw response with the HTTP tester.