Security Header Coach — One File Tools

Header Configurations

Pre-configured Policy Templates

Content-Security-Policy (CSP) Defends against XSS and script injection attacks.

CSP Directive List

default-src 'self'; script-src 'self' 'unsafe-inline' https:; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';

Ensure keywords ('self', 'none', 'unsafe-inline') are wrapped in single quotes.

Strict-Transport-Security (HSTS) Forces all client connections over HTTPS.

max-age (Seconds)

Include Subdomains (includeSubDomains) Allow Preloading (preload)

X-Frame-Options (Clickjacking) Restricts page framing by other websites.

Action directive

X-Content-Type-Options (nosniff) Blocks browsers from MIME sniffing response files.

Referrer-Policy (Privacy) Controls how much referrer metadata is sent on link clicks.

Privacy standard

Permissions-Policy Controls browser features (camera, microphone, location).

Allowed Features List

Good Protection

Overall security score: 85%

Coach Audit Findings

Generated Configuration Snippet