Security Headers Generator and Auditor

Browsers ship with many protections that stay off until a site asks for them with a response header. HSTS forces HTTPS, a Content-Security-Policy limits where scripts can come from, a frame policy stops clickjacking, and a few more close small gaps that attackers still use. Adding them is cheap, and checking that they are present on every response is the first step of most web security reviews. This page audits the headers you paste and builds a good set when you start from nothing.

The audit

Paste the headers of a response and the page grades them. Each missing or weak header is a finding with a severity and a one-line fix. The score starts at 100 and loses points for every finding, more for high-severity ones. The letter follows the score: A from 90, B from 75, C from 60, D from 40 and F below that. Because the audit reuses the checks of the CSP, HSTS, cookie and CORS tools on this site, a pasted Set-Cookie line is judged by the same rules as in the cookie auditor.

A worked example

Press Sample. The pasted response comes from a badly configured server, and the page grades it F with a score of 2 out of 100 and 13 findings. The high-severity ones are that the Content-Security-Policy is missing and that the cookie named “session” lacks the Secure and HttpOnly flags. Medium: the HSTS max-age is only 86400 seconds, X-Content-Type-Options: nosniff is missing, and no clickjacking protection is set. Low findings include the absent includeSubDomains, Referrer-Policy and Permissions-Policy, and two headers that reveal software, Server: nginx/1.18.0 and X-Powered-By: Express. Each finding carries a short explanation and the header to send.

What the main headers do

Strict-Transport-Security makes browsers use HTTPS only. Content-Security-Policy limits resource sources and also carries frame-ancestors for clickjacking. X-Content-Type-Options: nosniff stops browsers from guessing a file’s type and running an upload as a script. Referrer-Policy controls how much of the address is sent to other sites. Permissions-Policy switches off browser features you do not use. The cross-origin family, COOP, COEP and CORP, isolates your page from others.

The presets

Switch to the Build tab. Basic contains headers that are safe for almost any site: HSTS for one year, nosniff, a strict-origin-when-cross-origin referrer policy, SAMEORIGIN framing and a Permissions-Policy that turns off camera, microphone and geolocation. Balanced, meant for static sites and typical apps, adds a Content-Security-Policy that allows your own origin and inline styles, a two-year HSTS header and cross-origin headers that do not isolate the page. Strict is for high-security apps: it drops inline styles, sets frame-ancestors to none, uses same-origin COOP with require-corp COEP and adds the preload flag, and expect to change code to live with it. Test each preset on a staging copy before you deploy.

Applying the result

Pick your platform and copy the configuration: add_header lines for nginx, Header always set for Apache, a headers block for Caddy, a _headers file for Netlify and Cloudflare Pages, middleware for Express, web.config for IIS or vercel.json. Headers must be sent on every response, including errors and redirects.

Limits

The audit is a checklist of common weaknesses, not a penetration test. A site can score an A and still have injection or access-control bugs. The page works on text you paste and does not request your site, so test the headers that your production server actually sends, after any proxy or CDN has changed them.

Related tools

• CSP Generator and Evaluator builds the most important header in detail.
• HSTS Header Generator explains preload and rollout.
• Permissions-Policy Generator controls browser features.
• Cookie Security Auditor grades the cookies your site sets.