Services AI Systems & Intelligent Automation Cloud Platforms & Enterprise Architecture Cybersecurity, Identity & Governance Systems Integration & Business Automation Intelligent Web Platforms Infrastructure & Networking Managed Technology Services Case Study Industries Free tools About Contact Talk to an Architect
  1. Home
  2. Free tools
  3. Security headers generator
Tool 09 · Website security

The headers your site should send, as config you can paste.

Choose the third-party services the site uses, decide how strict to be, and get the Content-Security-Policy and the rest of the security headers in the format your platform expects. Run the website check first and the page pre-selects what is missing.

Start from your site

Reads the site's current headers and pre-selects the gaps.

1. Headers to send

2. Third-party services the site uses

Each one adds the exact origins it needs to the CSP. Anything not listed here will be blocked once the policy is enforced, which is the point.

Output

    Deployed it? Run the website check to confirm the grade ›

    Rolling out a CSP without breaking the site

    • Deploy as Content-Security-Policy-Report-Only. Nothing is blocked; violations appear in the browser console.
    • Open every page type (home, forms, checkout, embedded video, chat widget) and read the console. Add any origin that is legitimately needed.
    • Move inline <script> blocks into files. Inline event handlers such as onclick= also need to move.
    • Switch the header name to Content-Security-Policy. Keep watching the console for a week.

    Where the headers go

    On a CDN or hosting platform (Cloudflare, Vercel, Netlify) they are set once for the whole site and the tabs above give the exact format. On a self-managed server they belong in the web server config, not in application code, so they apply to error pages and static files too. WordPress sites usually get them from the web server or from a Cloudflare rule in front of the site.

    Common questions

    Google Tag Manager needs unsafe-inline. Is that true?
    Tag Manager itself does not, but tags it injects often do. The clean fix is a nonce-based policy, which Tag Manager supports, but it needs the nonce to be generated per request by the server. If the site is static, keep Tag Manager on its own origin and accept that some tags may need a hash added.
    Will HSTS break our intranet or mail host on a subdomain?
    includeSubDomains applies HSTS to every subdomain, so any subdomain served over plain HTTP becomes unreachable in browsers that have visited the main site. Check them all before adding the flag; leave it off if unsure.
    X-Frame-Options or frame-ancestors?
    Both. frame-ancestors in the CSP is the modern control and takes precedence; X-Frame-Options covers older browsers and scanners that still look for it.
    Website checkIntelligent Web Platforms
    Next step

    Want the platform built on these foundations?

    Every Intelligent Web Platform we ship scores an A on headers, serves a strict CSP, and is monitored after launch. If the current site cannot get there, that is a useful thing to know before the next redesign.

    Discuss Your Platform Intelligent Web Platforms