Security Header Builder | Useful Online Tools

Policy Directives

Configure HTTP Security Headers

Enable Content-Security-Policy (CSP) upgrade-insecure-requests

default-src

script-src

style-src

img-src

connect-src

font-src

frame-ancestors

Enable Strict-Transport-Security (HSTS) includeSubDomains preload

HSTS Max-Age

X-Frame-Options

Referrer-Policy

X-Content-Type-Options: nosniff

Permissions: Camera

Microphone

Geolocation

Payment API

Posture & Export

Generated Server Snippet

A+

Security Posture Score: 100 / 100

All recommended browser hardening headers are active with strict policies.

Configuration Output

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.example.com; font-src 'self' data:; frame-ancestors 'none'; upgrade-insecure-requests
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

Related in Security & Encoding

More tools in this category

View all tools →

Base64 Converter

Encode and decode Base64 strings with full UTF-8 support for text payloads and data URIs.

URL Encoder/Decoder

Escape or unescape special characters in URLs and query parameters safely.

Hash Generator

Compute MD5, SHA-1, SHA-256, and SHA-512 cryptographic hashes locally in your browser.

JWT Decoder

Decode and inspect JSON Web Token headers, payload claims, and expiration timestamps offline.