A security headers generator writes the few lines of server code that tell browsers to use HTTPS, block sneaky file tricks and stop other sites from framing your pages. Tick the headers you want, pick your server, and copy ready code for .htaccess, Nginx, Cloudflare or PHP. Safe defaults are already set, and risky options stay off until you choose them.
What are security headers?
Every time a browser asks for a page, your server answers with the page and a short list of notes called HTTP headers. Visitors never see them, but browsers read them. Security headers are notes that switch on protection the browser already has built in.
They cost nothing, they do not slow your site down, and they block a few common attacks. They are not a full shield against hackers. Updates, strong passwords and backups still matter more. Think of headers as locking the windows after you lock the front door.
Which headers does the tool add?
The tool follows the advice of the OWASP Secure Headers Project and MDN, but it picks values that will not break a normal blog or business site.
| Header | Value | What it does |
|---|---|---|
| Strict-Transport-Security | max-age=31536000 | Tells the browser to use HTTPS for a year, even if someone types http:// |
| X-Content-Type-Options | nosniff | Stops the browser from guessing file types, so a fake image cannot run as a script |
| X-Frame-Options | SAMEORIGIN | Only your own site may show your pages in a frame |
| Referrer-Policy | strict-origin-when-cross-origin | Other sites see only your domain, not the full page address |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Turns off camera, microphone and location for your pages and any embeds |
Frame protection guards against clickjacking. In that trick, a bad site loads your page in a hidden frame and makes visitors click buttons they cannot see. You can use X-Frame-Options or the newer CSP rule frame-ancestors 'self'. Both pass the check in our Website SEO Checkup.
How do I use the security headers generator?
- Make sure HTTPS works everywhere. Open a few pages, images and old posts with https://. If any part shows a warning, fix that first. Our guide to fixing mixed content shows how.
- Pick the HSTS time. Start with 5 minutes if you feel unsure. Move to 1 year when nothing breaks.
- Leave the other defaults on unless your pages must appear inside frames on other sites.
- Choose your server tab. Most shared hosts use Apache or LiteSpeed, so start there.
- Copy or download the code and add it in one place only.
- Check it. Press F12, open Network, reload, click the first line and read the Response Headers. Then run the checkup again.
Where does the code go?
Apache and LiteSpeed
Paste the block near the top of the .htaccess file in your main folder, usually public_html. Back up the file first. The code sits inside <IfModule mod_headers.c>, so it does nothing on a server without that module instead of causing an error. The word always makes Apache send the header on error pages and redirects too.
Nginx
Add the add_header lines to the server block that listens on port 443. Then test with nginx -t and reload. One catch: if a location block has its own add_header line, Nginx drops the server lines there. Repeat them in that block.
Cloudflare
If your site runs through Cloudflare, you can skip the server files. HSTS has its own switch under SSL/TLS, Edge Certificates. The other headers go in a Response Header Transform Rule. The tool writes the steps for you, with each header name and value.
PHP
Use the PHP lines only when you cannot edit .htaccess or the server config. They only cover pages made by PHP, not images or CSS files.
HSTS: start small, then go to one year
HSTS is the header people worry about most, and with good reason. Once a browser has seen it, that browser will refuse plain HTTP for your domain until the time runs out. If your certificate expires or one section still uses http://, visitors cannot get in, and you cannot switch it off for them from your end.
Browsers ignore HSTS on plain HTTP pages, so it only works after HTTPS is in place. A safe path is to start with 5 minutes, then try 1 day, and settle on 1 year once every page works. You can learn more in our guide on how to add HSTS and security headers.
includeSubDomains and preload
Both are off by default. includeSubDomains forces HTTPS on every subdomain, such as shop., mail. or an old test site. If one of them has no working certificate, it goes dark for your visitors.
preload asks browser makers to build HTTPS for your domain into the browser itself. The list at hstspreload.org needs max-age of at least one year plus includeSubDomains. Removal is possible, but it takes months to reach users through browser updates. Turn it on only if you are sure the whole domain will stay on HTTPS for good.
What about Content-Security-Policy?
A Content-Security-Policy (CSP) lists which places your page may load scripts, styles and images from. It is the strongest header, and also the one most likely to break things. Most blogs load code from ad networks, analytics, fonts and embeds, and a strict policy would block them.
That is why the tool only offers a starter policy in Report-Only mode. In that mode the browser blocks nothing. It only writes a note in the console each time the policy would have blocked something. Leave it running, open your pages with F12, Console, and read the notes. Change the policy to an enforced header only when those notes are clean.
Common mistakes
- Adding headers in two places. If your host, a plugin and .htaccess all send the same header, browsers may get two values. Pick one place.
- Turning on HSTS before HTTPS works. Fix redirects first. The .htaccess redirect generator makes a clean http to https rule.
- Setting preload just to get a better score. It does not raise your rankings, and it is hard to undo.
- Forgetting speed. While you have .htaccess open, add compression and caching with the .htaccess caching and gzip generator.
Security headers will not move you up in Google on their own, but they protect your visitors and fix the warnings that site checkers show. Use the security headers generator once, test the result, and you can forget about it until you move to a new host.
Frequently asked questions
Can security headers break my site?
The default set rarely breaks anything. HSTS can lock visitors out if HTTPS fails, so start with a short max-age. A strict Content-Security-Policy can block scripts, which is why the tool only offers it in Report-Only mode.
How do I remove HSTS?
Send the header again with max-age=0 over HTTPS. Browsers that see it forget the rule. Browsers that never come back keep the old rule until it expires, which is why a short test time comes first.
Is my data sent anywhere?
No. The generator runs in your browser and only saves your choices on your own device. Nothing you pick is uploaded to Bloghints.