Question 1

What are HTTP security headers?

Accepted Answer

Security headers are HTTP response headers that tell browsers how to protect your site, such as blocking clickjacking, enforcing HTTPS, limiting feature access and reducing XSS risk.

Question 2

Which headers should every website use?

Accepted Answer

Most modern sites should use Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and either X-Frame-Options or CSP frame-ancestors.

Question 3

Can I use the generated headers in Nginx or Apache?

Accepted Answer

Yes. Choose the output format to get raw headers, Nginx add_header directives, Apache Header set directives or Express.js middleware code.

Question 4

Does this tool scan my website?

Accepted Answer

No. It is a generator that runs entirely in your browser. Use it together with a security headers checker after deployment to verify the live response.