Security Headers Generator

Generate a solid baseline set of HTTP security headers, Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy and Permissions-Policy, with Nginx and Next.js snippets.

X-Frame-OptionsReferrer-Policy

HSTS (force HTTPS for 2 years, only enable once HTTPS is fully working)X-Content-Type-Options: nosniffPermissions-Policy (block camera/mic/location by default)Content-Security-Policy (starter policy, may need tuning for your scripts/styles)Allow inline styles (needed by many CSS-in-JS/utility frameworks)

Allowed image hosts (img-src)Space-separated, e.g. https://cdn.example.com

Raw HTTP headers

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
Content-Security-Policy: default-src 'self'; img-src 'self' data: *; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'

Nginx

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: *; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" always;

Next.js (next.config.ts)

async headers() {
  return [
    {
      source: "/:path*",
      headers: [
        { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
        { key: "X-Frame-Options", value: "SAMEORIGIN" },
        { key: "X-Content-Type-Options", value: "nosniff" },
        { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
        { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), interest-cohort=()" },
        { key: "Content-Security-Policy", value: "default-src 'self'; img-src 'self' data: *; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" },
      ],
    },
  ];
}

This Content-Security-Policy is a strict starting point, not a drop-in fit for every site. Test thoroughly: it will block any inline scripts, third-party scripts, or resources not explicitly allowed, and browsers will only report violations in the console rather than fail loudly.

Ad space

Frequently asked questions

Why should I add these headers?+

They're one of the highest-leverage, lowest-effort ways to harden a site against common attacks like clickjacking, MIME-sniffing exploits, and cross-site scripting, and they're checked by tools like Mozilla Observatory and securityheaders.com.

Will the Content-Security-Policy break my site?+

Possibly, a strict CSP blocks any script, style, or resource source not explicitly allowed. Test carefully in a staging environment and check your browser console for violation warnings before deploying.

Should I enable HSTS before HTTPS is fully working?+

No, HSTS tells browsers to only ever connect over HTTPS for a long period (up to 2 years here), so enabling it before HTTPS is fully and reliably working can lock out visitors.