# Security Headers Generator

> Pick your HSTS, CSP, framing and referrer settings and get ready-to-paste config for Next.js, nginx, Apache, Express, Vercel or Netlify.

Category: Security. This tool runs in your browser.

Open the interactive tool: https://www.devkult.com/tools/security/security-headers-generator

## FAQ

### Which security headers should every site send?

Start with X-Content-Type-Options: nosniff, a Referrer-Policy, X-Frame-Options (or CSP frame-ancestors) and a Permissions-Policy — they rarely break anything. Add Strict-Transport-Security once HTTPS works everywhere, and a Content-Security-Policy in report-only mode first.

### Why is the CSP report-only by default?

A Content-Security-Policy that blocks too much can break scripts, styles and third-party embeds. Report-only mode logs every violation in the browser console without blocking anything, so you can adjust the policy before enforcing it.

### Is HSTS preload safe to enable?

Only when every subdomain serves HTTPS and you're sure you'll keep it that way. Preloaded domains are built into browsers, and getting removed takes months, so a mistake can make subdomains unreachable over HTTP for a long time.

### Does this tool send my settings anywhere?

No. The configuration is generated in your browser.

## More Security tools

- [JWT Decoder](https://www.devkult.com/tools/security/jwt-decoder.md): Decode and inspect JWT tokens — header, payload, and signature.
- [Hash Generator](https://www.devkult.com/tools/security/hash-generator.md): Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes locally in your browser.
- [Bcrypt Tester](https://www.devkult.com/tools/security/bcrypt-tester.md): Generate and verify Bcrypt password hashes securely.
- [UUID/ULID Generator](https://www.devkult.com/tools/security/uuid-generator.md): Generate bulk UUIDs (v4) and ULIDs for your applications.
- [Password Generator](https://www.devkult.com/tools/security/password-generator.md): Generate strong random passwords with crypto.getRandomValues. Pick the length and character sets and see the entropy. Nothing leaves your browser.