Skip to content
My Blog

Search WPDesignVault

Try "image", "json", "schema" or "contrast". Use arrow keys to move through results.
WordPress Tools

HTTP Security Headers Generator

Generate recommended HTTP security headers for your site and get them as Apache, Nginx or WordPress PHP code.

Runs in your browser. Nothing you enter is uploaded. Last updated
Strict-Transport-Security (HSTS)
Basics
Content-Security-Policy
Format

    How to use

    1. Tick the headers you want and adjust their values.
    2. Start Content-Security-Policy in Report-Only mode so it cannot break your site.
    3. Copy the format that matches your server and deploy it on a staging site first.

    What this tool does

    It produces standard header lines and explains each option. The safest headers (nosniff, Referrer-Policy, frame protection) are on by default; HSTS preload and enforced CSP are off because they can have lasting or breaking effects.

    Why it matters

    Security headers tell browsers to enforce HTTPS, refuse to be framed by other sites, avoid MIME sniffing and limit powerful features, which reduces the impact of common attacks.

    Tips

    • Only enable HSTS once every subdomain works over HTTPS.
    • WordPress themes and plugins often use inline scripts; an enforced CSP needs careful testing.
    • Some hosts and CDNs let you set headers in their dashboard instead.

    Frequently asked questions

    Is X-Frame-Options still needed?

    The CSP frame-ancestors directive replaces it in modern browsers, but sending both is harmless and covers older ones.

    What does HSTS preload do?

    It lets browsers ship your domain in a built-in HTTPS-only list. Removal is slow, so only use preload when you are sure.

    Related tools

    WordPress .htaccess Generator

    Generate a WordPress .htaccess file with the default rewrite rules and optional HTTPS and www redirects, file protection,…

    wp-config.php Generator

    Generate a complete wp-config.php with database details, newly generated security keys, debug settings and useful constants. Keys are…

    301 Redirect Generator

    Paste old and new URLs to generate exact-match redirect rules for Apache (.htaccess), Nginx or a WordPress snippet.…

    Custom Post Type Generator

    Generate clean, translation-ready register_post_type() code for WordPress with labels, supports, archives and block editor settings.

    Related guides