Every tool runs in your browser — your text, images and files are never uploaded.
Pick the security headers you need and copy ready code for Apache or LiteSpeed .htaccess, Nginx, Cloudflare or PHP. Covers HSTS with a safe test mode, nosniff, frame protection, Referrer-Policy, Permissions-Policy and a Report-Only CSP starter, with clear warnings on preload. Runs in your browser.
Choose file types and cache times and copy ready code for Apache or LiteSpeed .htaccess (mod_deflate, mod_brotli, mod_expires, Cache-Control) or Nginx (gzip and expires). Short cache for HTML, long cache for versioned CSS, JS and images. A header checker shows if it worked. Runs in your browser.
Paste your page URLs, or paths plus your domain, and get a clean sitemap.xml. The tool removes duplicates and #fragments, checks host and https, escapes special characters, adds lastmod dates if you want, and splits lists over 50,000 URLs or 50 MB with a sitemap index. Runs in your browser.
Turn a logo, photo, letters or an emoji into favicon.ico (16, 32, 48 px), PNG icons in 48, 96, 180, 192 and 512 px, a site.webmanifest and the head tags. Live preview in a browser tab and a Google result, light and dark. Download each file or a zip. Your image never leaves your device.
Enter an https page address, or paste its source, and see every file that still loads over http://: images, scripts, style sheets, iframes, fonts, video, forms and CSS url() calls. Active and passive files are marked, each with the https address to use, plus a CSV export. Nothing is stored.
Build JSON-LD structured data for Organization, WebSite, Article or BlogPosting, FAQPage, LocalBusiness, BreadcrumbList and Person. A live check marks missing required and recommended fields and bad URLs or dates. Copy the script, then test it in the Rich Results Test. Runs in your browser.
No tool matches your search.