$megatools --security-headers --client-side

Security Headers Generator

Generate hardened HTTP security headers (CSP, HSTS, CORS, X-Frame-Options) for Nginx, Vercel, Apache.

Target Web Server / Framework Config

Configure Security Directives (6 Enabled)

Strict-Transport-Security

Forces HTTPS connections and protects against downgrade attacks.

X-Frame-Options

Prevents clickjacking by disabling embedding in iframes.

X-Content-Type-Options

Stops browsers from MIME-sniffing away from the declared content-type.

Referrer-Policy

Controls how much referrer info should be included with requests.

Permissions-Policy

Restricts access to browser features like camera, mic, and geolocation.

Content-Security-Policy

Restricts sources of executable scripts, stylesheets, and assets.

nginx Configuration Output

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;" always;