Web Defense & A+ SSL Labs Grade
Security Headers & CSP Generator
Build zero-vulnerability HTTP security headers and Content Security Policies (CSP) to protect against XSS, clickjacking, and injection attacks.
Advertisement
Sponsored Space
Platform:
Standard Security Headers
CSP Allowed Services (Non-Breaking)
Select third-party CDNs used by your project to automatically whitelist them without breaking fonts or scripts.
Advertisement
Sponsored Space
security-headers.conf (nginx)
# Security Headers for Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://www.googletagmanager.com https://www.google-analytics.com https://js.stripe.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self' https://www.google-analytics.com https://api.stripe.com https://cloudflareinsights.com; frame-src 'self' https://js.stripe.com; object-src 'none'; base-uri 'self'; form-action 'self'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;