Back to All Tools
OWASP Security Hardener

HTTP Security Headers & CSP Hardener

Construct enterprise-grade HTTP response headers to achieve an A+ security rating. Prevent Clickjacking (X-Frame-Options), Cross-Site Scripting (CSP), and MIME sniffing.

HTTP Security Headers & CSP Hardener

A+ Grade

Generate enterprise-grade HTTP security headers, Content Security Policies, and HSTS rules for Nginx, Next.js, and Cloudflare.

Security Policies
Generated Configuration Snippet:
// next.config.js or next.config.mjs
/** @type {import('next').NextConfig} */
const nextConfig = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [
          {
            key: 'Strict-Transport-Security',
            value: "max-age=31536000; includeSubDomains; preload",
          },
          {
            key: 'X-Frame-Options',
            value: "DENY",
          },
          {
            key: 'X-Content-Type-Options',
            value: "nosniff",
          },
          {
            key: 'Referrer-Policy',
            value: "strict-origin-when-cross-origin",
          },
          {
            key: 'Permissions-Policy',
            value: "camera=(), microphone=(), geolocation=(), payment=()",
          },
          {
            key: 'Content-Security-Policy',
            value: "default-src 'self'; script-src 'self' https://static.cloudflareinsights.com 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self';",
          },
        ],
      },
    ];
  },
};

module.exports = nextConfig;
Active Header Rules (6)
Strict-Transport-Securitymax-age=31536000; includeSubDomains; preload
X-Frame-OptionsDENY
X-Content-Type-Optionsnosniff
Referrer-Policystrict-origin-when-cross-origin
Permissions-Policycamera=(), microphone=(), geolocation=(), payment=()
Content-Security-Policydefault-src 'self'; script-src 'self' https://static.cloudflareinsights.com 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self';
OWASP Secure Headers Compliance RecommendedSecureStack WAF

Content Security Policy (CSP)

Restrict script execution origins, font stylesheets, and image embeds to eliminate persistent XSS attack vectors.

HSTS Preload Protection

Enforce TLS encryption across all subdomains with max-age configurations ready for Chromium/Mozilla HSTS preload lists.

Multi-Server Configurations

Instant copy-paste syntax for Nginx, Next.js `next.config.js`, Cloudflare Workers, and Apache `.htaccess`.