HTTP security headers tell browsers how to handle content types, framing, referrer information, powerful browser features, HTTPS enforcement, and content loading. This generator creates a conservative Apache or Nginx baseline that can be tested and adapted to a WordPress website.
Choose a server format and generate a conservative baseline. Test Content Security Policy separately before enforcing it.
How this tool helps
Headers can break forms, embedded content, analytics, fonts, payment flows, and page builders when applied without testing. Content Security Policy and HSTS require particular care. Start with reporting or a staging environment and confirm every major website function.
How to use it
- Select the server format.
- Choose the headers required by the website.
- Generate and copy the configuration.
- Apply it on staging, inspect browser console errors and response headers, then move the tested configuration to production.
Frequently asked questions
Does adding headers make a website completely secure?
No. Headers reduce selected browser risks. Updates, access control, backups, monitoring, secure code, and hosting remain essential.
Should HSTS be enabled immediately?
Only after HTTPS works correctly on the complete domain and required subdomains. A long HSTS policy can make HTTP recovery difficult.
Why is CSP generated in report-only mode?
Report-only mode helps identify blocked resources before an enforcing policy affects visitors.
Important: Review generated configuration before using it on a production website and confirm detector results against the website you are researching.