Security Headers Config Generator turns your choices into ready-to-paste configuration for nginx, Apache, IIS (web.config), Caddy or a _headers file for Cloudflare Pages and Netlify. It covers HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and the cross-origin policies, and can hide server version banners.

How to read the result

The output is one block of configuration with a comment saying where it goes. For nginx each header is an add_header ... always; line, so it is also sent on error pages. For Apache the headers sit inside <IfModule mod_headers.c>. For IIS the block is a web.config fragment with values XML-escaped. The notes under the output call out the settings that need care, such as HSTS preload.

Defender tips

Enable HSTS only after every subdomain serves HTTPS if you choose includeSubDomains, and treat preload as close to permanent.
In nginx, an add_header inside a location block replaces all headers inherited from the server block. Repeat the full set there or use an include file.
Start a new Content-Security-Policy in report-only mode, fix what the reports show, then enforce it.
After deploying, check the live result with the HTTP Header Analyser; caches and CDNs sometimes drop or override headers.

FAQ

Which X-Frame-Options value should I use?

DENY unless your own pages frame each other, then SAMEORIGIN. The CSP frame-ancestors directive is the modern control; keeping both covers older browsers.

Can I remove the Server header completely?

On IIS 10 and later, yes. nginx without extra modules can hide the version but not the name, and Apache can reduce it to the product name.

Is anything sent to Vulnera?

No. The configuration is generated in your browser.