Network
Build CSP, HSTS, CORS, and Permissions-Policy headers plus SRI hashes.
Runs entirely in your browser
Nothing you paste is uploaded. Monaco and Prettier load on demand from this origin.
Header
Directives
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'
There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to security headers generator
- Choose headers. Pick the security headers you want to configure.
- Set values. Tune directives like CSP sources and HSTS max-age.
- Copy. Add the headers (and any SRI hash) to your server or tags.
A handful of security headers meaningfully harden a site — CSP against XSS, HSTS to enforce HTTPS, frame options against clickjacking. Building them correctly is fiddly, and this tool composes valid values plus SRI hashes for CDN assets.
See the HTTP header reference for the full header landscape and the robots.txt generator for crawler control.
Frequently asked questions
What is Content-Security-Policy?
A header that restricts which sources scripts, styles, and other resources can load from, mitigating XSS. The builder helps you compose a policy without syntax mistakes.
What is Subresource Integrity?
An integrity hash on a <script> or <link> so the browser refuses a file that's been tampered with — important when loading assets from a CDN. The tool generates the hash locally.
Is anything uploaded?
No. Header text and SRI hashes are generated in the browser, so nothing leaves the tab.