Advertisement
Guide
About the Security Headers Generator
Security headers are HTTP response headers that switch on protections built into the browser: HTTPS-only connections, no framing by other sites, no MIME sniffing, tighter referrer leaks and blocked access to powerful features like the camera. They cost nothing at runtime and are a standard item on security audits.
Choose a preset, adjust each header, and copy a block for your server. CORS rules for APIs are included, with correct handling for more than one allowed origin.
Why CORS allows only one origin
Access-Control-Allow-Origin takes a single origin or *. To allow several, the server checks the request’s Origin header against a list and echoes it back, adding Vary: Origin so caches keep a copy per origin. The nginx, Apache and Express outputs do exactly that.
Cross-origin isolation
Some APIs, such as SharedArrayBuffer and precise timers, need the page to be cross-origin isolated: Cross-Origin-Opener-Policy: same-origin plus Cross-Origin-Embedder-Policy: require-corp. That also blocks any cross-origin resource that does not opt in, so test embeds and CDNs carefully.
How to use it
- 1Pick the preset closest to your site or API.
- 2Adjust HSTS, framing, referrer and feature permissions.
- 3Turn on CORS if browsers on other domains call you.
- 4Copy the block for your server and check it with curl -I.
Frequently asked questions
Which security headers should every site have?
Strict-Transport-Security, X-Content-Type-Options: nosniff, a frame policy (X-Frame-Options or CSP frame-ancestors), Referrer-Policy and a Content-Security-Policy. Permissions-Policy is a good addition.
Is X-XSS-Protection still needed?
No. Modern browsers removed the XSS auditor it controlled. OWASP recommends either leaving it out or sending X-XSS-Protection: 0 to switch it off in old browsers.
What max-age should HSTS use?
Start with a few minutes while testing, then raise it to one or two years. The preload list requires at least one year plus includeSubDomains.
Why does my CORS request fail with credentials?
With credentials, browsers reject the * wildcard. The server must echo the exact origin and send Access-Control-Allow-Credentials: true, and the client must set credentials: "include".
Does Permissions-Policy affect iframes?
Yes. A feature blocked in the header is blocked for every frame on the page too. An iframe can only get a feature the parent allows, through its allow attribute.
How do I check the headers on my site?
Run curl -I https://yoursite.com, or open DevTools → Network, click the document request and look at Response Headers.