Security Headers Builder Guide
This builder writes a starting set of security headers for Nginx, Apache, or Cloudflare. HSTS preload is off until you enable it. Copy the lines into your server. The page does not change the live response.
Overview
The draft includes Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Nginx uses add_header. Apache uses Header always set. Cloudflare is a list of header names and values for a transform or response-header rule. Leave preload off until HSTS has been stable on every subdomain you are willing to include.
What to check before you publish
- Server format: Nginx, Apache, and Cloudflare snippets are not interchangeable.
- Preload: Turn it on only after the whole domain is ready.
- Live check: The headers analyzer reads the published response, not this draft.
Headers in the draft
| Header | Draft value | Purpose |
|---|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains | Force HTTPS |
| X-Content-Type-Options | nosniff | Stop MIME sniffing |
| X-Frame-Options | SAMEORIGIN | Limit framing |
Example Nginx lines
Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;Recommended Remediation Flow
- Choose the server Select Nginx, Apache, or Cloudflare so the syntax matches where you will paste it.
- Publish the headers Reload the server or save the Cloudflare rule. This page does not do that.
- Check the live response Open the security headers analyzer with the site URL filled in.
Troubleshooting Common Issues
The checker still shows the header missing
The config may not be on the response you tested.
- Confirm you reloaded Nginx or Apache.
- Confirm the Cloudflare rule matches that hostname.
- Request the same URL the checker uses.
Validation Checklist
Post-fix validation
- The live response includes the headers you published.
- Preload is off unless you chose it.
- The builder did not change the server by itself.
FAQ
Does this publish headers?
No.
- You copy the draft.
- You apply it on Nginx, Apache, or Cloudflare.
- Then you check the live URL.