Security Lab

Security Headers Architect & Policy Generator

Configure, lint, and export hardened HTTP security headers. Includes contextual risk analysis, breaking change prevention, and copy-ready syntax for Cloudflare Pages, Nginx, Caddy, and Apache.

Policy Directives

Interactive Builder

Architecture Presets

Hardened zero-trust baseline ideal for pre-rendered content sites with no external scripts.

Content-Security-Policy (CSP)Report-Only Mode

script-srcSeparate sources with spaces. Avoid 'unsafe-inline'.

style-src

object-srcRecommended 'none' to block Flash/plugins and legacy object embedding.

frame-ancestors (Clickjacking protection)

upgrade-insecure-requests (Auto-rewrite HTTP to HTTPS)

Strict-Transport-Security (HSTS)

max-age (Duration in seconds)

includeSubDomains (Applies to all subdomains)preload (Browser binary baking - Irreversible)

Transport & Metadata Policies

X-Content-Type-Options: nosniff (Prevents MIME sniffing)

Referrer-Policy

Permissions-Policy: Disable unused hardware (camera, mic)

Contextual Risk Assessment & Linter

[Content-Security-Policy] ADVISORY

Policy is in active enforcement mode.

Test initial CSP rules using Content-Security-Policy-Report-Only first to identify blocked assets without breaking user experience.

Generated Configuration

/*
  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

Security Architecture Notice: HTTP security headers provide critical defense-in-depth, but do not replace server-side input validation, strict authentication controls, or secure code practices. Always stage test policies before deploying in production.

Deployment Strategy

Four-Stage Zero-Downtime CSP Rollout Protocol

Deploying a strict Content-Security-Policy in production without testing will break legitimate analytics, fonts, and customer payment widgets. Follow this proven four-phase procedure.

Phase 01

Telemetry Gathering

Ship Content-Security-Policy-Report-Only headers pointing to a collection endpoint. The browser executes all scripts normally while logging violations in background threads.

Phase 02

Third-Party Triage

Review log data over 14 days to capture rare cron triggers, payment gateways, and tag managers. Add necessary origins to script-src and connect-src directives.

Phase 03

Kill Unsafe-Inline

Replace dangerous 'unsafe-inline' declarations with cryptographic SHA-256 hashes for static script blocks or server-generated nonces for dynamic server rendering.

Phase 04

Active Enforcement

Switch the header name to Content-Security-Policy. Browsers now actively block injection attempts and untrusted script execution across your entire application.

Server Nuances

Configuration Gotchas Across Web Servers

Different hosting platforms process header inheritance differently. Be aware of these server-specific behaviors before deploying configuration files.

Platform	Configuration File	Critical Architecture Traps
Cloudflare Pages	public/_headers	Rules match line-by-line. Does not support regex wildcards or server-side environment variables.
Nginx	nginx.conf	Defining add_header inside a child location block cancels all add_header directives from parent blocks completely.
Caddy	Caddyfile	Caddy manages TLS and basic HSTS automatically. Avoid duplicate header declarations in custom directives.
Apache	.htaccess	Requires mod_headers enabled. Always use "Header always set" to ensure headers attach to error pages (such as 404 and 500).

Knowledge Base

Frequently Asked Questions

Concise answers regarding HTTP security headers, policy testing, and safe production deployment.

How do you deploy a Content-Security-Policy without breaking existing features?

Start with Content-Security-Policy-Report-Only and configure a report-to endpoint. Monitor violation reports for two weeks to identify all legitimate external scripts and stylesheets before enforcing the policy.

What is the danger of enabling HSTS preload too early?

HSTS preload is permanently hardcoded into browser engines and takes months to remove. If your HTTPS certificates expire or any subdomains lack SSL, users are completely blocked from accessing your website.

Should I use nonces or hashes for Content-Security-Policy?

Use SHA-256 hashes for static sites (such as Astro or Vite SSG) where inline scripts do not change. Use cryptographic nonces for dynamic server-rendered applications where the server generates unique per-request tokens.

Why does Nginx add_header sometimes fail to send security headers?

Nginx add_header directives do not inherit from parent configuration blocks if a child location block defines its own add_header. Child blocks must re-declare all inherited security headers.