Web / Security

Security Header Explainer

Understand important HTTP security headers and create practical examples for Apache, Nginx or PHP. The guide explains common use cases, risks and sensible starting values.

Why security headers matter

Security headers are HTTP response headers that tell the browser to apply additional security rules. They do not replace secure coding, HTTPS configuration or server hardening, but they can reduce common risks such as clickjacking, excessive referrer data, unnecessary browser features or unsafe embedding.

This tool combines a guide with a generator. You can look up the most important headers, filter them and create a matching example block for your server environment.

Header guide

Search for a header or filter by topic. The cards explain purpose, benefit and typical starting values.

Generator section

Choose output format, profile and individual headers. The resulting example code is generated live and can be copied or downloaded.

Output format

Profile

X-Frame-Options Protection against unwanted embedding.Referrer-Policy Controls which referrer information is shared.Permissions-Policy Restricts browser features.Strict-Transport-Security Enforces future HTTPS access.Content-Security-Policy Defines allowed resource sources.X-Content-Type-Options Prevents MIME sniffing.Cross-Origin-Opener-Policy Optional isolation for window contexts.

X-Frame-Options

Referrer-Policy

Permissions-Policy

HSTS max-age

includeSubDomainspreload

Content-Security-Policy

CSP must be extended deliberately for external scripts, images, fonts or advertising.

Cross-Origin-Opener-Policy

Output

Limits and verification

The generator creates example configurations. Whether a header works correctly depends on the server, framework, proxies, CDN rules and external services. Verify the final response headers with browser developer tools or a suitable test tool after deployment.