Original Savana Security tool · Free browser-side builder

Header Policy Studio

Build a review-ready starter configuration for common browser security response headers. Choose your server, customize safe options, and export the template. It never connects to your website, performs scans, installs software, or transmits your configuration choices to a scanner.

Free to use No account required Generated on your device

1. Choose the deployment context

Hosting / web server

Content Security Policy (CSP)

Report-only does not block resource loading. This template does not create a CSP violation-report collection endpoint.

Embedding / framing

Referrer information

HTTPS Strict Transport Security (HSTS)

HSTS instructs browsers to prefer HTTPS for future visits. It can persist after a configuration change. No preload or includeSubDomains is generated.

Disable camera, microphone and geolocation Include Permissions-Policy restrictions only if these browser features are not required.

A safe starter template will appear below.

2. Review your generated template

This is editable configuration text, not a security certification. Back up existing server settings, test changes in staging, and verify the actual HTTP response after deployment.

3. Review before deploying

What this tool can—and cannot—do

These are original configuration templates, not automated vulnerability scans. They require application-specific review. A configuration that is valid for one site can break another. Cloudflare Pages _headers does not cover Pages Functions, Nginx can change add_header inheritance, and Apache has multiple response-header tables. This tool does not modify anything on your server.

The editor keeps selected options in the current page only. No user-entered domain names, passwords, tokens, telemetry about selections, scans, or customer data are needed. The page may still create normal hosting access logs.

Background references: Cloudflare Pages headers, Nginx add_header, Apache mod_headers, OWASP guidance.

Request help reviewing your configuration Go back to Website Health