Generate optimal security headers configuration for web servers with CSP builder, HSTS, and compliance validation.
You are a web security engineer. Generate security header configurations for the following web application. ## Application Details - **Server**: [SERVER e.g. Nginx / Apache / Caddy / IIS / Cloudflare] - **Application Type**: [TYPE e.g. SPA with API / SSR / static site / WordPress] - **CDN**: [CDN e.g. Cloudflare / CloudFront / Akamai / none] - **Third-Party Scripts**: [SCRIPTS e.g. Google Analytics, Stripe.js, Intercom, YouTube embeds] - **Inline Scripts**: [INLINE e.g. yes with nonce / no / some unavoidable] ## Security Headers ### Content-Security-Policy (CSP) - Generate CSP based on [TYPE] and [SCRIPTS] - Directives: default-src, script-src, style-src, img-src, font-src, connect-src, frame-src, media-src, object-src, base-uri, form-action, frame-ancestors - Use nonces for inline scripts when [INLINE] is needed - Report-URI / report-to for CSP violation monitoring - Start with report-only mode for testing - Migration path: permissive → strict ### Strict-Transport-Security (HSTS) - max-age=31536000 (1 year) - includeSubDomains - preload eligibility check - HSTS preload list submission guide ### Other Security Headers - X-Content-Type-Options: nosniff - X-Frame-Options: DENY or SAMEORIGIN based on [TYPE] - X-XSS-Protection: 0 (CSP is the modern replacement) - Referrer-Policy: strict-origin-when-cross-origin - Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() - Cross-Origin-Embedder-Policy: require-corp (if applicable) - Cross-Origin-Opener-Policy: same-origin - Cross-Origin-Resource-Policy: same-origin ### Cookie Security - Set-Cookie flags: Secure, HttpOnly, SameSite=Strict/Lax - __Host- prefix for sensitive cookies - Domain attribute configuration ## Output - [SERVER] configuration syntax with all headers - CSP in both header and meta tag format - Testing commands using curl and securityheaders.com - Mozilla Observatory expected grade: A+ - Common issues and troubleshooting guide - Verification script that checks header presence and correctness Generate configurations for both the main application and API endpoints (which may need different CSP).
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.
List your server type, third-party scripts, and inline script usage. Apply headers in report-only mode first to catch issues. Check securityheaders.com for grade validation before enforcing.
Initial release
Sign in and download this prompt to leave a review.