Header Prism

HTTP header & security policy tools

04HSTS · CSP · framing · referrer · isolationGenerator

Security headers generator

Pick a value for each header and get configuration your server accepts as-is, with a live grade on the same scale as the analyzer.

A

Headers

defaults = recommended

Strict-Transport-Security

Options

Content-Security-Policy

Framing, sniffing and referrer

X-Content-Type-Options

Permissions-Policy

Cross-origin isolation

Legacy and clean-up

B

Configuration

8 headers
98 / 100

Points lost: Cross-origin isolation −2.


						

						

					

				

			

		

	


	

		

			
Rolling out security headers safely

			
Most of these headers are safe to add on day one: X-Content-Type-Options, Referrer-Policy, X-Frame-Options and a Permissions-Policy that turns off features you never use. Three need care.

			

				
Strict-Transport-Security

				
Start with a short max-age, check that every page and subdomain works over HTTPS, then raise it to a year. Browsers remember the setting, so a mistake cannot be undone by changing the header back.

				
Content-Security-Policy

				
Send it as Report-Only first and fix what it reports. The default here only allows your own origin, which breaks third-party scripts until you list them.

				
Cross-Origin-Opener-Policy

				
same-origin breaks sign-in and payment popups that talk back to your page; use same-origin-allow-popups if you rely on them.

			

			
After deploying, paste the response headers into the header analyzer to confirm what the server actually sends. In nginx, remember that add_header in a location block replaces the headers inherited from server.

		

	


	

		
FAQ
Security headers questions

		

			

				Do I still need X-Frame-Options with frame-ancestors?
				
Browsers ignore X-Frame-Options when the CSP has frame-ancestors, but sending both is harmless and covers old clients and tools that only check X-Frame-Options.

			

			

				Why is X-XSS-Protection off by default?
				
Chrome and Edge removed the XSS filter it controlled, and Firefox never had one. In the old browsers that still have it, the filter itself could leak information, so the safest value is 0 or no header at all.

			

			

				Where does the grade come from?
				
The generated headers are scored with the same published points as the header analyzer, so you can see what each choice is worth before you deploy it.