HTTP Security Headers Generator: CSP, HSTS and More

Tick the headers you need and copy a ready-made configuration for Nginx, Express, Vercel or Apache servers.

HTTP security headers: generated values and server setup

The tool outputs a configuration block for Nginx, Express, Vercel or Apache with up to six headers: one-year HSTS with preload, a basic CSP, X-Frame-Options (DENY or SAMEORIGIN), X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin and a Permissions-Policy that turns off camera, microphone and geolocation. The values follow current specifications but are less strict than the OWASP reference list.

Generated headers

HeaderGenerated valueEffect
Strict-Transport-Securitymax-age=31536000; includeSubDomains; preloadHTTPS enforced for 1 year (31,536,000 s), subdomains included
Content-Security-Policydefault-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;allowed sources for scripts, styles and images
X-Frame-OptionsDENY or SAMEORIGINclickjacking protection
X-Content-Type-Optionsnosniffno MIME type sniffing
Referrer-Policystrict-origin-when-cross-originonly the origin is sent to other sites
Permissions-Policycamera=(), microphone=(), geolocation=()camera, microphone and geolocation disabled

Example (Nginx, DENY)

Each line looks like this; the always keyword also adds the header to error responses:

add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;

Limits of the generated code

  • Referrer-Policy cannot be changed.
  • The CSP allows 'unsafe-inline' for scripts, which weakens XSS protection; nonces or hashes are safer.
  • The preload directive comes from hstspreload.org, not RFC 6797: submission requires max-age ≥ 31,536,000, includeSubDomains and HTTPS on every subdomain, and removal takes months.

The OWASP list updated on 04/10/2026 goes further: two-year HSTS (63,072,000 s) without preload, Referrer-Policy no-referrer, X-Frame-Options deny. MDN notes that the CSP frame-ancestors directive offers more options than X-Frame-Options, and that strict-origin-when-cross-origin has been the browser default since the November 2020 revision of the Fetch standard.

Sources and dates: RFC 6797, HSTS (November 2012); hstspreload.org requirements; OWASP Secure Headers reference list (04/10/2026); MDN, X-Frame-Options and Referrer-Policy (checked 14/10/2026).

Frequently Asked Questions

What max-age should I use for HSTS?

The tool uses 31,536,000 seconds, one year, which is the minimum for the hstspreload.org preload list together with includeSubDomains and preload. OWASP recommends 63,072,000 seconds (2 years). Under RFC 6797, max-age=0 tells the browser to forget the site's HSTS policy.

Should I use X-Frame-Options or CSP frame-ancestors?

Both stop your pages from being shown in a third-party iframe. DENY blocks all framing, SAMEORIGIN allows only your own domain. MDN says frame-ancestors offers more options, and that the ALLOW-FROM value of X-Frame-Options is obsolete: modern browsers then ignore the whole header.

Why does 'unsafe-inline' weaken a Content-Security-Policy?

With 'unsafe-inline' in script-src, any script written directly in the page runs, including one injected through an XSS flaw. The tool includes it so that sites relying on inline scripts keep working. For real protection, replace it with nonces or SHA-256 hashes of the allowed scripts.

Which Referrer-Policy should I choose?

The tool sets strict-origin-when-cross-origin: full URL to your own site, origin only to other HTTPS sites, nothing to an HTTP site. It has been the browser default since the November 2020 revision of the Fetch standard. OWASP recommends no-referrer, which sends nothing at all.

Is this tool really free?

Yes, all tools on Kristools are 100% free and accessible without registration.

Is my data protected?

Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.