Security Headers Builder

Draft HSTS and related security headers for Nginx, Apache, or Cloudflare. This page does not publish the headers.

Server

Strict-Transport-Security

HSTS max-age31536000 is one year.

includeSubDomains

HSTS preloadLeave preload off until HSTS has been stable on every subdomain.

X-Content-Type-Options nosniff

X-Frame-Options

Frame policy

Referrer-Policy

Permissions-Policy

Site to check afterward

These lines are a draft. Publishing them is a separate step on your server or Cloudflare.

Draft record

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Check live security headers after you publish the draft yourself. These builders do not publish DNS, do not change headers, and do not start Mail Watch.