Build CSP, CORS, HSTS, and other security headers
# Security Headers - Nginx Configuration add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; add_header Cross-Origin-Opener-Policy "same-origin" always; add_header Access-Control-Allow-Origin "*" always; add_header Access-Control-Allow-Methods "GET, POST" always;
The Security Header Generator builds ready-to-paste HTTP response headers that harden your web application against common attacks. It produces Content-Security-Policy (CSP) directives such as default-src, script-src, style-src, img-src and connect-src, along with Strict-Transport-Security (HSTS), Cross-Origin Resource Sharing (CORS) headers like Access-Control-Allow-Origin, plus X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
It is aimed at web developers, DevOps engineers, and security teams who need correct header syntax without memorizing every directive. Instead of hand-writing policies that browsers silently ignore when malformed, you configure options in the form and copy the exact header strings into your Nginx, Apache, or application config.
Content-Security-Policy is an allowlist that tells the browser which sources of scripts, styles, images, and other resources are trusted. A policy like default-src 'self'; script-src 'self' https://cdn.example.com blocks inline scripts and any third-party code not explicitly listed, which is the primary defense against cross-site scripting (XSS). Directives are separated by semicolons and each takes a space-separated list of source expressions.
Strict-Transport-Security forces browsers to use HTTPS for a set period. The header Strict-Transport-Security: max-age=31536000; includeSubDomains; preload instructs the browser to refuse plain HTTP for one year across all subdomains, and the preload flag makes it eligible for the browser-maintained HSTS preload list.
CORS headers govern which external origins may read responses via JavaScript. Access-Control-Allow-Origin defines the permitted origin; note that combining a wildcard * with Access-Control-Allow-Credentials: true is rejected by browsers, so you must echo a specific origin when credentials are needed. Supporting headers such as X-Frame-Options: DENY prevent clickjacking and X-Content-Type-Options: nosniff stops MIME-type sniffing.
Yes, it is completely free. The headers are generated entirely in your browser from the options you select, so your policy values and origins are never uploaded to a server.
A strong baseline is default-src 'self'; object-src 'none'; base-uri 'self'. Then add specific origins or nonces to script-src and style-src for any legitimate third-party resources your pages use.
For production, 31536000 seconds (one year) is standard and required if you want to submit to the HSTS preload list. Use a short value like 300 while testing so you can roll back quickly if HTTPS breaks.
The Fetch specification forbids the wildcard when Access-Control-Allow-Credentials is true. You must return the exact requesting origin instead, and add Vary: Origin so caches serve the correct response per origin.
Avoid it when possible, because 'unsafe-inline' allows inline scripts and largely defeats the XSS protection CSP provides. Prefer nonces or hashes so only specific inline blocks are permitted.
Set them as HTTP response headers in your web server (add_header in Nginx, Header set in Apache) or in your application middleware. Meta tags can only carry a subset of CSP and cannot set HSTS or CORS.
Use Content-Security-Policy-Report-Only first. It reports violations to the browser console and any report-uri endpoint without blocking resources, letting you refine directives before enforcing them.