FAQSign inAnalyse a website

Security headers generator

Pick the protections you need and copy ready-made configuration for your host.

Security & domainGeneratorFree
Security headers generatorRuns in your browser
Headers to add
_headers7 lines
/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Checking …

One moment while we look up this website.

What you’ll get

A ready-to-use file, no code needed.

  • A live preview as you fill it in
  • Copy or download in one click
  • Hand it to your developer, or paste it in yourself
Example result

How it works

  1. Fill in the detailsSigned in, we pre-fill them from your latest report.
  2. Preview the resultSee exactly what will be published as you type.
  3. Copy or downloadPaste it into your site, or send it to your developer.

Why it matters

  • Security headers tell browsers to force HTTPS, refuse to be framed by other sites and stop guessing file types. They block whole classes of attack with a few lines of config.

  • Turn on HSTS only once every page works on HTTPS, and test a Content-Security-Policy before enforcing it.

Questions

Can headers break my site?

A strict Content-Security-Policy can block scripts you rely on, so test it first. The other headers here are safe for almost every site.

How do I check they work?

Run a free Pagelyt scan after deploying: the Security area lists any header that is still missing.

More free tools

13 tools. One free account.Check AI access, crawling, how you look in Google, security and more. Nothing to install.Browse all tools

Want the full picture?

This tool checks one thing. A free Pagelyt scan checks speed, SEO, AI readiness, security and more, and tells you what to fix first.

Analyse My WebsiteBook a consultation