Bitnesia Tools

← Back

🛠️

Security Headers Generator

Generate production-ready security headers configuration for web servers and frameworks. Copy-paste ready with comments.

Select Platform

Nginx

Hybrid Mode

Configure both your web server/reverse proxy and application framework. The infrastructure handles static headers while the framework handles dynamic/contextual headers.

1. Select Infrastructure (Required)

Nginx

Reverse Proxy / Web Server

Apache

Web Server

Caddy

Modern Web Server

2. Select Framework (Optional) Leave empty for infrastructure-only setup

Express.js

Node.js

Next.js

React

Flask

Python

Django

Python

FastAPI

Python

Gin

Fiber

Laravel

PHP

Rails

Ruby

Axum

Rust

Header Responsibility Matrix

Header

Infrastructure

Framework

HSTS

✓

X-Frame-Options

✓

CSP

✓

✓ (Dynamic)

Permissions-Policy

✓

Basic Settings

Domain

HTTPS Port

Configuration Preset

Strict

Maximum security, restrictive CSP

Balanced

Good security + functionality

Minimal

Basic security only

Enable HSTS (HTTP Strict Transport Security)

Include Subdomains Preload (Submit to HSTS Preload List)

Include Cross-Origin Resource Policy (CORP) headers

Enable Permissions Policy

Control access to browser features like camera, microphone, and location

Geolocation

Camera

Microphone

Notifications

Payment

Idle Detection

Enable Custom CSP Configuration

Override preset CSP with custom directives. Leave empty to use preset defaults.

default-src Default policy for all resources

'self' https: 'none'

script-src JavaScript sources

'self' 'unsafe-inline' 'unsafe-eval' https:

style-src CSS stylesheets

'self' 'unsafe-inline' https:

img-src Images

'self' data: blob: https:

connect-src Fetch/XHR/WebSocket

'self' https:

frame-ancestors Embedding control (Clickjacking)

'self' 'none'

CSP Preview:

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'self'

Generating configuration...