Home › Free tools › Security headers generator
Pick your server and the protections you want. You get a config block to paste, and a warning on the two settings that are genuinely hard to undo.
Runs in your browser. Nothing is sent anywhereTells browsers to use HTTPS for your domain without trying HTTP first.
X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy are safe on essentially any site and rarely break anything. Add HSTS once every hostname serves HTTPS properly. Leave Content-Security-Policy until last, because it needs testing.
Content-Security-Policy can, by blocking resources you actually use. HSTS can make a site unreachable if you later cannot serve HTTPS, because browsers honour it for the full max-age. Everything else in this generator is low risk.
On Apache or LiteSpeed, in .htaccess at your web root or in the virtual host. On nginx, inside the server block. On Caddy, in the site block. On Netlify, in a _headers file. On IIS, in web.config. The generator produces the correct syntax for each.
Usually a CDN or proxy in front of your origin is stripping, overriding or serving a cached response. Always verify against your public hostname rather than the origin, using curl -I or a browser's network panel.