Loading…
Generate secure HTTP headers for your web application. Review the result before reusing it in another workflow.
7/11
Headers Enabled
4/4
Critical
Enforces HTTPS connections
Controls resources the browser can load
Prevents MIME type sniffing
Prevents clickjacking attacks
Legacy XSS filter (use CSP instead)
Controls referrer information sent
Controls browser features and APIs
Isolates browsing context
Prevents loading cross-origin resources
Controls resource sharing
Controls caching behavior
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self';" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;