Generate a complete set of HTTP security headers tailored to your site requirements: Content-Security-Policy, HSTS, X-Frame-Options, Permissions-Policy, COEP, COOP, and more.
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; frame-src 'none'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: accelerometer=(), ambient-light-sensor=(), payment=(), camera=(), microphone=(), geolocation=(), gyroscope=(), magnetometer=(), usb=(), interest-cohort=() Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin
Defines approved sources for content (scripts, styles, images, etc.). Prevents XSS attacks by blocking unauthorized script execution.
Mitigates: Cross-Site Scripting (XSS), code injection, data exfiltration
Controls whether the page can be embedded in an iframe. Prevents clickjacking attacks.
Mitigates: Clickjacking, UI redressing attacks
Prevents browsers from MIME-sniffing a response away from the declared Content-Type. Stops drive-by download attacks.
Mitigates: MIME confusion attacks, drive-by downloads
Controls how much referrer information is sent with requests. Protects user privacy and prevents sensitive URL leakage.
Mitigates: Privacy leakage, sensitive URL exposure in referrer header
Controls which browser features and APIs can be used (camera, microphone, geolocation, etc.). Limits attack surface.
Mitigates: Unauthorized access to browser APIs, feature abuse
Forces HTTPS connections. Prevents protocol downgrade attacks and cookie hijacking over HTTP.
Mitigates: SSL stripping, HTTP downgrade attacks, man-in-the-middle
Prevents documents from loading cross-origin resources that haven't opted in. Required to enable SharedArrayBuffer and high-res timers.
Mitigates: Spectre-based side-channel attacks, cross-origin data leakage
Isolates the browsing context group from cross-origin popups. Prevents cross-origin attacks via window references.
Mitigates: Cross-origin information leakage via window.opener
Prevents other origins from reading your resources. Protects images and scripts from cross-site leaks.
Mitigates: Cross-site leaks, unauthorized resource inclusion
marduc812
2026