HTTP Header Builder

Runs in browser Web

Build correct header sets from presets (secure defaults, no-cache, CORS allow list, JSON API) and export them as raw headers, cURL flags, Nginx, Apache or Cloudflare _headers syntax.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use HTTP Header Builder

  1. Tick the presets that match your resource (for example "Secure defaults" plus "Immutable static assets").
  2. Add or override individual headers in the custom list.
  3. Choose the export format for your server or client and, for Cloudflare, the path pattern.
  4. Copy the configuration block into your server config or deployment repository.

HTTP Header Builder features

  • Ten presets: secure defaults, strict nonce CSP, no-cache, immutable static assets, HTML revalidation, public CORS, credentialed CORS, JSON API, file download, rate-limit headers
  • Custom headers with RFC 9110 name validation and header-injection protection
  • Deterministic merge rules: later values override, Vary lists merge, Set-Cookie and Link may repeat
  • Export as raw headers, cURL -H flags, Nginx add_header, Apache mod_headers, Cloudflare/Netlify _headers, JSON, fetch or axios
  • Explanations for every header in the resulting set plus warnings for contradictory combinations
  • Live preview while you toggle presets

HTTP Header Builder example

Nginx configuration for a JSON API with credentialed CORS

Input:

Presets: JSON API response, CORS: allow-listed origin with credentials · Export: Nginx

Output:

add_header Content-Type "application/json; charset=utf-8" always;
add_header Cache-Control "no-store" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Access-Control-Allow-Origin "https://app.example.com" always;
add_header Access-Control-Allow-Credentials "true" always;
…
add_header Vary "Origin" always;

Frequently asked questions about HTTP Header Builder

Which security headers should every site send?

The "Secure defaults" preset covers the OWASP baseline: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy, Permissions-Policy and the Cross-Origin-* isolation headers. Add a Content-Security-Policy tailored to your app.

How do I export the headers for my web server?

Choose Nginx (add_header … always;), Apache (Header always set …) or Cloudflare Pages / Netlify (_headers file with a path). The cURL export produces -H flags for quick testing.

What happens if a custom header has the same name as a preset header?

Custom headers win. Set-Cookie and Link may repeat; Vary values are merged into a single comma-separated list.

What is {NONCE} in the strict CSP preset?

A placeholder for a per-response random value. Generate at least 128 bits of randomness, base64-encode it, put it in the header and on every <script nonce="…"> tag.

Technical notes

Header values are emitted verbatim; only double quotes are escaped for Nginx and Apache. Remember that Nginx add_header directives in a nested location replace, rather than extend, those inherited from the server block.