Configuration

Basic Protection

HSTS (Strict-Transport-Security)Enforce HTTPS connections

X-Content-Type-OptionsPrevent MIME type sniffing

X-Frame-OptionsPrevent clickjacking attacks

Referrer PolicyControl referrer information

Content Security Policy (CSP)

Default Src

Script Src

Style Src

Image Src

Generated Code

const helmet = require('helmet');

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ['self'],
      scriptSrc: ['self'],
      styleSrc: ['self'],
      imgSrc: ['self'],
      connectSrc: ['self'],
      fontSrc: ['self'],
      objectSrc: ['none'],
      mediaSrc: ['self'],
      frameSrc: ['none'],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  },
  frameguard: {
    action: 'deny',
  },
  referrerPolicy: {
    policy: 'no-referrer',
  },
}));

Security Headers Generator

Generate secure HTTP headers and Helmet.js configurations to protect your website from attacks.

How to Use

Configure Headers

Toggle the security headers you want to enable, such as HSTS, X-Frame-Options, and X-Content-Type-Options.

Set CSP Rules

Define your Content Security Policy (CSP) to control which resources the user agent is allowed to load.

Copy Code

Copy the generated configuration code for Helmet.js, Nginx, or Apache and add it to your server configuration.

Frequently Asked Questions

What are security headers?

Security headers are HTTP response headers that tell the browser how to behave when handling your website's content, helping to prevent various attacks.

What is Helmet.js?

Helmet.js is a popular Node.js middleware that helps secure Express apps by setting various HTTP headers.

Why do I need HSTS?

HTTP Strict Transport Security (HSTS) tells browsers that your website should only be accessed using HTTPS, preventing man-in-the-middle attacks.

What is Clickjacking?

Clickjacking is an attack where a malicious site tricks a user into clicking on something different from what the user perceives. X-Frame-Options helps prevent this.

What does X-Content-Type-Options do?

It prevents the browser from trying to guess ('sniff') the MIME type, forcing it to stick to the declared content type. This prevents XSS attacks via file uploads.

What is Content Security Policy (CSP)?

CSP is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks.

How do I use the generated Nginx code?

Add the generated `add_header` directives to your Nginx server block or location block configuration file.

Can I use these headers on any website?

Yes, standard HTTP headers are supported by all modern browsers and can be configured on any web server (Apache, Nginx, IIS, etc.).

Is X-XSS-Protection still necessary?

It is largely obsolete in modern browsers which have strong built-in XSS protection, but some legacy systems may still benefit from it.

What is Referrer Policy?

It controls how much referrer information (sent via the Referer header) should be included with requests made from your site.