Security Headers Generator

Strict-Transport-Security Force HTTPS (HSTS)max-age includeSubDomains preload

Content-Security-Policy Send a CSP Report-only (log, don't block)

Framing, sniffing & referrersX-Frame-Options X-Content-Type-Options: nosniffReferrer-Policy Remove X-Powered-By

Permissions & isolationDisable features this site never uses:

cameramicrophonegeolocationpaymentusbbrowsing-topics

Cross-Origin-Opener-PolicyCross-Origin-Resource-Policy

infoCheck that every subdomain supports HTTPS before shipping includeSubDomains with a long max-age; start with max-age=300 if unsure.
infoCSP is in report-only mode: violations are logged, nothing is blocked. Switch to enforcing once the console is quiet.

Config

// next.config.js
const securityHeaders = [
  { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },
  { key: "Content-Security-Policy-Report-Only", value: "default-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" },
  { key: "X-Frame-Options", value: "DENY" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
];

module.exports = {
  poweredByHeader: false,
  async headers() {
    return [{ source: "/(.*)", headers: securityHeaders }];
  },
};

Frequently Asked Questions

Which security headers should every site send?

Start with X-Content-Type-Options: nosniff, a Referrer-Policy, X-Frame-Options (or CSP frame-ancestors) and a Permissions-Policy — they rarely break anything. Add Strict-Transport-Security once HTTPS works everywhere, and a Content-Security-Policy in report-only mode first.

Why is the CSP report-only by default?

A Content-Security-Policy that blocks too much can break scripts, styles and third-party embeds. Report-only mode logs every violation in the browser console without blocking anything, so you can adjust the policy before enforcing it.

Is HSTS preload safe to enable?

Only when every subdomain serves HTTPS and you're sure you'll keep it that way. Preloaded domains are built into browsers, and getting removed takes months, so a mistake can make subdomains unreachable over HTTP for a long time.

Does this tool send my settings anywhere?

No. The configuration is generated in your browser.