Security headers · CSP builder · deployment snippets

Generate security headers before you test them live

Build CSP, HSTS, Referrer-Policy, Permissions-Policy, nosniff, and frame headers in this browser. Export HTTP header text plus Cloudflare Pages, Netlify, Apache, and Nginx snippets, then verify the deployed response with the live checker.

POLICIESCSP + HSTSEXPORTS5 FORMATSDEPLOYMENTREVIEW FIRST

HEADER SCOPE

Plan where the policy will apply

Use a path scope for `_headers` files or paste the final HTTPS origin when you want absolute rule output.

Final HTTPS origin optionalRule scope 2 / 240CSP modeupgrade-insecure-requests Ask supporting browsers to upgrade HTTP subresources.

CONTENT SECURITY POLICY

Declare the sources your page actually needs

Use one source list per directive. The generator removes duplicates, drops unsupported tokens, and warns on broad or risky values.

default-src Fallback source list for fetch directives.script-src JavaScript sources. Avoid unsafe-inline/eval unless you know why.style-src Stylesheet sources. Prefer hashes/nonces for inline styles.img-src Image sources, including data: only when needed.font-src Font files and provider origins.connect-src Fetch, API, analytics, and websocket destinations.frame-src Frames loaded by your page.frame-ancestors Sites allowed to embed this page.base-uri Controls the base URL tag.form-action Allowed form submission destinations.object-src Usually 'none' for modern sites.manifest-src Web app manifest location.worker-src Workers, service workers, and blob worker use.

BROWSER POLICY HEADERS

Add conservative companion headers

These headers support safer defaults, but they still need staging review because production scripts, embeds, forms, and payment flows can need exceptions.

Strict-Transport-Security Only for HTTPS hosts that are ready to stay HTTPS.HSTS max-age secondsincludeSubDomains Apply HSTS to every subdomain in scope.preload Requires extra HSTS conditions before submission.Referrer-PolicyX-Frame-OptionsX-Content-Type-Options: nosniff Reduce MIME type confusion.

CameraGeolocationMicrophonePaymentUSBFullscreen

REPORTING

Keep report endpoints explicit

Report URLs are optional. If supplied, they must be HTTPS and controlled by your team before deployment.

report-uri endpoint optional HTTPS URLreport-to fallback endpoint optional HTTPS URL

Release workflow: generate a policy, review it in staging, deploy it to the correct host layer, then check the live response with OpenWebmaster’s security headers checker. This generator does not deploy headers, prove server support, verify policy compatibility, run a browser security test, establish compliance, or claim ranking impact. Exports include openwebmaster-security-headers.csv, openwebmaster-security-header-findings.csv, openwebmaster-security-header-generator.json, openwebmaster-cloudflare-_headers, and openwebmaster-netlify-_headers.

CSP

Ready for a real header policy.

No sample CSP, security score, compliance badge, vulnerability result, ranking benefit, or manufactured header report appears before you choose policy settings.

PUBLIC RELEASE NOTES

Generate, stage, then verify the live response

Start strict where possible

Use `'self'`, explicit provider origins, `object-src 'none'`, and `base-uri 'self'` before adding broader exceptions.

Roll CSP carefully

Use report-only mode for discovery when a production site has unknown third-party scripts, then move to enforcement after fixes.

Match the host layer

Cloudflare Pages, Netlify, Apache, and Nginx snippets are formatted differently. Review the selected output against the platform that will serve the final response.