Security Headers Starter
Configure HSTS, nosniff, referrer, feature, framing and optional cross-origin policies as raw HTTP, nginx or Worker code.
security-headersLOCAL WORKSPACE
1. Configure and explore
Inputs stay in this tab; no browser persistence, page-URL encoding or network requests.
2. Results and interpretation
Choose a sample, fill the fields or explore the flow.
This is a starter, not an audit. HSTS requires HTTPS; COOP can break OAuth windows and CORP can block embedded resources.
Data / rules date: 2026-10-21 · Official source
How to use this tool
Start with short HSTS age, choose required policies and review popup, embedding and subdomain risks before applying output.
When not to use it
This is a starter, not an audit. HSTS requires HTTPS; COOP can break OAuth windows and CORP can block embedded resources.
Read the guide →