RubanTools
Suggest a Tool

HTTP Header Generator

Configure CORS, CSP, Cache-Control and security headers visually - copy Nginx or Apache config blocks.

CORS
Content Security Policy
Cache-Control
Security Headers
Output

Security Headers FAQ

Security headers are HTTP response headers that instruct browsers on security policies - preventing XSS, clickjacking, MIME sniffing, and data leakage. Common ones: Content-Security-Policy (script sources), X-Frame-Options (clickjacking), Strict-Transport-Security (HTTPS-only), X-Content-Type-Options (MIME sniffing). Check your score at securityheaders.com.

CORS (Cross-Origin Resource Sharing) controls which origins can make requests to your server from a browser. Access-Control-Allow-Origin: * allows all origins (use only for public APIs). Access-Control-Allow-Credentials: true requires a specific origin, not *. Preflight OPTIONS requests check permissions before complex requests.

CSP restricts which resources (scripts, styles, images) a page can load. default-src 'self' only allows resources from the same origin. script-src 'none' blocks all scripts. Use Content-Security-Policy-Report-Only to test without enforcing - violations are reported but not blocked. Start strict and loosen as needed.