Browser-local workflow

Website Security Headers Toolkit

Design and review a coordinated set of HTTP security and delivery headers without unsafe combinations.

Best for
Web developers and site owners hardening an application before or after launch.
Expected outcome
A reviewed header set with rollout notes, server snippets, and fewer contradictory directives.

Run the tools in this order

  1. 1

    Limit cross-origin access

    Choose allowed origins, methods, headers, and credential behavior for API responses.

    Open tool
  2. 2

    Build a Content Security Policy

    Start in report-only mode and make allowed resource sources explicit.

    Open tool
  3. 3

    Restrict browser features

    Control access to camera, microphone, geolocation, and other powerful features.

    Open tool
  4. 4

    Set cache behavior

    Separate public static assets from private or personalized responses.

    Open tool
  5. 5

    Publish a security contact

    Create an RFC 9116 file so researchers know how to report a vulnerability.

    Open tool

Checks before you finish

  • Test headers in a staging environment before enforcing them in production.
  • Never combine a wildcard CORS origin with credentialed requests.
  • Confirm every CSP source is required; avoid broad wildcards when possible.
  • Recheck caching on authenticated and user-specific responses.