Build a Content-Security-Policy header from 13 directives such as script-src, form-action and frame-ancestors.
Apache .htaccess Snippets
Runs locally
Use Apache .htaccess Snippets
What it does
Combine common Apache .htaccess blocks into one file: HTTPS redirect, HSTS, security headers, caching, compression, IP blocking and more.
It runs entirely in your browser: nothing you enter is uploaded.
Example
HTTPS and security headers
Keep the default ticks (HTTPS Redirect and Security Headers) and press Generate.# HTTPS Redirect
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# Security Headers
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-XSS-Protection "1; mode=block"
Header set Referrer-Policy "strict-origin-when-cross-origin"A RewriteRule that sends http:// requests to https:// with a 301 redirect, followed by four Header set lines.
FAQ
What do I need to change before using a snippet?
Replace the placeholders: yourdomain.com in Block Hotlinking and the sample addresses in Block IPs. The blocks need mod_rewrite, mod_headers, mod_expires or mod_deflate, and Block IPs uses Apache 2.4 Require syntax.
Are all the headers still recommended?
X-XSS-Protection is obsolete: major browsers have removed the XSS filter it controls, and current guidance is to omit it or send 0, so delete that line from Security Headers. Keep preload in the HSTS header only if every subdomain serves HTTPS and you plan to submit the domain to the browser preload list.
Is anything sent to my server?
No. The tool only joins the selected snippets into text in your browser, and nothing is uploaded. Test the file on a staging site first, because a syntax error in .htaccess makes Apache answer 500 for the whole directory.