Security headers generator
Switch each security header on or off and get ready-to-paste config for nginx, Apache, Cloudflare or a _headers file. Everything runs in your browser; nothing is sent anywhere.
Your config
Pick where you'll install it. After adding it, reload your server config and click Re-check.
What are security headers?
They are lines your server sends with every page telling the browser to switch on extra protection: always use HTTPS, don't let other sites secretly frame your pages, don't guess file types, and limit how much of your page address leaks. They don't replace patching, but they are quick to add.
Add them a group at a time, make sure the site still works, then confirm with the security headers check.
Frequently asked questions
Can adding security headers break my website?
Most headers (X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Permissions-Policy) rarely cause problems. HSTS and Content-Security-Policy need care: HSTS forces browsers to use HTTPS only, and a wrong CSP can block scripts, fonts or analytics. Try them on a test environment first.
What max-age should I use for HSTS?
Start small (300 seconds) to test. Once you are sure the whole site works over HTTPS, raise it to 1 day and then 1 year (31536000). Only enable preload after running 1 year with includeSubDomains.
Why use Content-Security-Policy-Report-Only first?
Report-Only mode only reports violations in the browser console without blocking anything. You see which pages are affected, add missing sources, and only then switch to Content-Security-Policy to enforce it.
Where do I add headers on a WordPress site?
If you use Cloudflare, add them with Transform Rules. If your host runs Apache, add the Header lines to the .htaccess file in the site root. If your host runs nginx, ask your hosting provider or use their control panel.
Check your whole website's security for free
Beyond security headers, WebsiteScanner checks SSL, SPF/DMARC, exposed sensitive files and more, with an A–F grade and fixes.