Security Headers Generator

Generate HSTS, X-Content-Type-Options, CSP, COOP + more.

✅ 100% free✅ No signup✅ Runs in your browser✅ No data sent to servers

Output

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=(self)
Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; script-src 'self' 'unsafe-inline'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin

Why this tool survives the ChatGPT era

Google + AI crawlers demote sites without HTTPS + strict security headers.

Frequently asked

HSTS max-age?

63072000 (2 years) is the browser-preload requirement.

Ship all of this at scale with WBP Omni SEO Pro

Every generator on this page can auto-apply across thousands of WordPress URLs — schema, meta, hreflang, robots, llms.txt — with GEO, AEO and AIO built in.

See pricing →