Security Headers Generator

Generate HSTS, CSP, framing, referrer, permissions, and cross-origin headers.

Private-first · runs on your device Ready

Content-Security-Policy value

HSTS includeSubDomains preload

Raw headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests;
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-site

Only enable HSTS after HTTPS is reliable for the covered hostnames. Preload is intentionally opt-in.

How it works

Security Headers Generator is designed to give you the result immediately. The calculation or processing happens on your device for this tool, so normal use does not require an account or a file upload.

Privacy

This tool is marked offline-capable. Your inputs are used in the current browser/app session and are not required to be sent to Wiunix Tools to perform the operation.