twobotechnologies

Free tool

Security Header Builder

Choose your HSTS policy, a starter Content-Security-Policy and the other essential headers, then copy ready-to-paste configuration for your server.

Runs locally in your browser. Nothing you paste or generate is sent anywhere.

Strict-Transport-Security (HSTS)
Content-Security-Policy starter
Other headers 

  

  
    

      
    

    In one sentence
    The builder produces a recommended set of HTTP security headers (HSTS per RFC 6797, a deny-by-default Content-Security-Policy starter, X-Content-Type-Options nosniff, Referrer-Policy and optional Permissions-Policy and X-Frame-Options) and formats them for nginx, Apache httpd, IIS web.config, Jetty rewrite rules or a static host's _headers file, with warnings for unsafe HSTS preload settings.
        
    
      
    How do I use the Header Builder?
    

    Pick your options, choose your server tab, copy the configuration and test it.
    

      

    1. Set HSTS: max-age, includeSubDomains, preload.
      2. 

    2. Configure the CSP starter: add the script, API and image hosts your site needs, and keep Report-Only on at first.
      3. 

    3. Choose the other headers.
      4. 

    4. Pick nginx, Apache, IIS, Jetty, a static host or raw output.
      5. 

    5. Deploy to a test environment, check the browser console for CSP reports, then enforce.
      6. 

    

    What does each header do?
    

    


    
Header
Effect

    
    


    
Strict-Transport-Security
Browser uses only HTTPS for this host for max-age seconds

    

    
Content-Security-Policy
Allowlists sources for scripts, styles, images, frames and connections

    

    
X-Content-Type-Options: nosniff
Stops MIME type sniffing

    

    
Referrer-Policy
Limits how much of the URL is sent to other sites (protects codes and tokens in URLs)

    

    
Permissions-Policy
Disables powerful features such as camera and geolocation

    

    
X-Frame-Options
Legacy clickjacking protection

    
    

    

    Where do server-specific details matter?
    

    In inheritance and quoting rules.
    

      

    • nginx: add_header in a location block replaces server-level headers; use always so headers are also sent on error responses.
      • 

    • Apache: requires mod_headers; use Header always set.
      • 

    • IIS: custom headers in web.config; IIS 10 version 1709 and later also has native per-site HSTS settings.
      • 

    • Jetty: rewrite module rules; for PingFederate, use its response header configuration files. See HSTS on Jetty-based servers.
      • 

    • Static hosts: a _headers file at the site root on hosts that support it.
      • 

    

    Is anything sent to a server?
    

    No. The configuration is generated in your browser.
    
      
    Questions
    

    Which HSTS max-age should I use?
    Start with a few minutes while testing, then raise it in steps to one year (31536000) or two (63072000). Preload lists require at least one year plus includeSubDomains.
    

    Why start CSP in Report-Only mode?
    A strict policy often blocks something you forgot, such as an analytics script or an image host. Report-Only shows violations in the browser console without blocking, so you can adjust before enforcing.
    

    Do I still need X-Frame-Options?
    CSP frame-ancestors replaces it in current browsers. Sending X-Frame-Options as well only helps very old browsers; it is optional.
    

    Is X-XSS-Protection included?
    No. Modern browsers have removed the XSS auditor that header controlled, and the header can cause problems. Use CSP instead.
    

    
    
    

    Related reading
      
    
  
    Other tools
    JWT Decoder & Inspector
    Decode a JWT's header and claims, check expiry, spot risky algorithms and verify HS256 signatures locally.
    PKCE Generator
    Create a code_verifier and its S256 code_challenge, plus random state and nonce values, with WebCrypto.
    SAML Response Decoder
    Decode POST and Redirect binding messages, pretty-print the XML and pull out issuer, subject, conditions and attributes.
    Authorization URL Builder
    Build an OAuth 2.0 or OpenID Connect authorize URL parameter by parameter, with warnings for insecure combinations.