Security Header Generator
Generate security headers for Apache, nginx or Caddy, with the two that can take a site offline flagged.
About this tool
Generates the standard set of security response headers as configuration for Apache, nginx or Caddy.
**Two of these are not safely reversible, and the tool says so rather than emitting them quietly.**
`Strict-Transport-Security` is cached by the browser. Once a visitor has seen a `max-age` of a year, their browser refuses to speak HTTP to your domain for a year — whatever the server sends afterwards. There is no way to recall it. The output starts at a few minutes and explains how to work up.
`includeSubDomains` extends that to every subdomain, including ones nobody remembered: a staging box, an old mail interface, a client's white-labelled host. Any of those still on HTTP becomes unreachable for everybody who has visited the main site.
Content-Security-Policy is deliberately not generated blind. A policy that does not match the page breaks it, and the only way to write one correctly is from what the page actually loads.
Common questions
Why start HSTS at a low max-age?
Because it cannot be withdrawn. A browser that has seen max-age=31536000 will refuse HTTP for your domain for a year even if you remove the header entirely. Start at 300 seconds, confirm nothing broke, then raise it.
What breaks with includeSubDomains?
Every subdomain not serving valid HTTPS. Staging environments, legacy mail interfaces and anything a third party hosts on a subdomain of yours all become unreachable for visitors who have seen the header.
Why is there no Content-Security-Policy here?
Because a policy that does not match the page breaks the page, and the correct policy depends entirely on what that page loads. Generating one from a checkbox produces something that either blocks your own scripts or allows everything.
Is X-XSS-Protection still needed?
No. Every current browser has removed the feature, and the filter it enabled introduced vulnerabilities of its own. It is included as an explicit 0 only because some scanners still ask for the header to be present.