Security • HTTP Headers CORS • CSP • HSTS • Preflight

HTTP CORS & Security Header Generator

Construct hardened CORS preflight responses and modern security headers for Nginx, Apache, Node.js, and Cloudflare Workers.

Access-Control-Allow-Origin

Allowed HTTP Methods

Allowed Request Headers

Allow Credentials (Access-Control-Allow-Credentials: true) Strict-Transport-Security (HSTS 1-year preload)

Nginx Configuration Block