Why is this output framework-agnostic instead of Nginx/Apache/Express-specific like the CSP and CORS generators?

These particular headers (HSTS, X-Frame-Options, Permissions-Policy, COOP/COEP) are simple static name/value pairs with no per-request logic, so the raw `Header-Name: value` line is universally useful, you paste it into whatever mechanism your stack uses to set static headers, without needing five separate syntax variants.

What do COOP and COEP actually protect against?

Cross-Origin-Opener-Policy: same-origin isolates your page's browsing context from cross-origin windows that open it (preventing certain cross-window attacks), and Cross-Origin-Embedder-Policy: require-corp requires every resource your page embeds to explicitly opt in via CORP or CORS. Together they enable "cross-origin isolation," a browser security posture required for some powerful APIs (like SharedArrayBuffer with high-resolution timers).

Will enabling COOP/COEP break anything?

Possibly. COEP's require-corp mode blocks any cross-origin resource (image, script, iframe) that doesn't send a matching Cross-Origin-Resource-Policy or CORS header, so a page that embeds third-party content without CORP support can break. Test thoroughly after enabling this pair, it's the one toggle here most likely to have real side effects.

Why would I set a Permissions-Policy row with an empty allowlist, like camera=()?

An empty allowlist, `()`, disables that feature entirely for your page and any framed content, even for your own origin. It's the strictest setting and a common default for features (camera, microphone, geolocation) a typical site has no legitimate use for.

HTTP Security Headers Generator - HSTS, Permissions-Policy, COOP/COEP

Overview

Introduction

Beyond CSP and CORS, a handful of other headers, HSTS, X-Frame-Options, Permissions-Policy, and the newer COOP/COEP pair, round out a solid HTTP security header baseline, but each has its own easy-to-forget syntax quirks.

This tool generates all of them as plain, framework-agnostic header lines you can drop into any server config, one place to get the syntax right regardless of what you're deploying on.

What Is HTTP Security Headers Generator?

A generator for HSTS (with includeSubDomains/preload toggles), X-Frame-Options (DENY/SAMEORIGIN/none), repeatable Permissions-Policy feature rows, and an optional Cross-Origin-Opener-Policy plus Cross-Origin-Embedder-Policy pair.

The output is raw `Header-Name: value` lines, the universal representation you translate into your specific server's syntax for setting static response headers.

How HTTP Security Headers Generator Works

Each toggle/row maps directly to one output line: HSTS's three settings combine into a single semicolon-separated value, each Permissions-Policy row becomes one `feature=(allowlist)` clause joined by commas into a single header, and COOP/COEP are a fixed pair enabled together since they're designed to be used in tandem.

Only headers you've enabled or given a value appear in the output, so the generated snippet stays proportional to what you've actually configured.

When To Use HTTP Security Headers Generator

Use it to round out a security header baseline after setting up CSP and CORS separately, this tool covers the remaining commonly recommended headers.

It's also useful when you specifically need cross-origin isolation (COOP/COEP) for an API like SharedArrayBuffer and want the exact header pair without having to recall both names and values.

Often used alongside CSP Header Generator, CORS Configuration Generator and SSL/TLS Config Generator.

Features

Advantages

Covers HSTS, X-Frame-Options, Permissions-Policy, and COOP/COEP together, headers that are easy to individually forget when set up over multiple separate changes.
Permissions-Policy rows are fully custom, supporting any feature name rather than a fixed preset list.
Framework-agnostic raw header lines translate directly into any server's "set a static header" mechanism.

Limitations

Doesn't wrap the output in server-specific syntax (add_header, Header set, etc.), you apply that wrapping yourself based on your stack.
COOP/COEP can break embedded cross-origin content that doesn't send a matching CORP/CORS header; this tool doesn't audit your page's actual embedded resources for compatibility.

Examples

HSTS plus two restricted Permissions-Policy features

Input

HSTS: enabled (max-age 63072000, includeSubDomains, preload), Permissions-Policy rows: camera=(), geolocation=(self)

Output

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Permissions-Policy: camera=(), geolocation=(self)

HSTS's three settings combine into one semicolon-joined value, and both Permissions-Policy rows join into a single comma-separated header value.

Best Practices & Notes

Best Practices

Only submit a domain to the HSTS preload list after includeSubDomains and preload have been live and working correctly for a while, removal from the list can take months to propagate.
Default Permissions-Policy features you don't use to an empty allowlist `()` rather than leaving them unset, an explicit deny is clearer than relying on browser defaults.
Roll out COOP/COEP behind a staging environment first and check the browser console for blocked cross-origin resources before enabling in production.

Developer Notes

HSTS, Permissions-Policy, and COOP/COEP are each independent, order-preserving line emitters; Permissions-Policy specifically joins each `{feature, allowlist}` row into a `feature=(allowlist)` clause per the header's structured-field syntax, then joins all clauses with `, ` into the single final header value.

HTTP Security Headers Generator Use Cases

Rounding out a security header baseline alongside separately configured CSP and CORS
Enabling cross-origin isolation (COOP/COEP) for an API that requires it
Locking down browser features (camera, microphone, geolocation) a site doesn't use via Permissions-Policy

Common Mistakes

Enabling HSTS preload before thoroughly testing HTTPS across every subdomain, since removal from browsers' preload lists is slow.
Enabling COEP's require-corp without checking that all embedded cross-origin resources (ads, widgets, fonts) actually support CORP/CORS, silently breaking them.

Tips

Use the Cloudflare Pages Security Headers Generator instead if you're deploying specifically to Cloudflare Pages, it outputs directly to the _headers file format with the same header set plus CSP in one place.

HTTP Security Headers Generator