---
title: "Generate HTTP security headers"
method: POST
path: "/security-headers/generate"
tags: ["web"]
---

# Generate HTTP security headers

`POST /security-headers/generate`

## Request

- Base URL: `https://intodns.ai/api`
- URL: `https://intodns.ai/api/security-headers/generate`
- Auth: none required

Generate HTTP security headers (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP) from a named preset or a full config. Returns the header list plus ready-to-paste outputs for Nginx, Apache, Caddy, Cloudflare, _headers files, and raw header lines. Pure compute — no network calls.

## Request body

- SecurityHeadersGenerateRequest: Provide either a named preset or a full config. If both are present, config wins and preset is ignored.
  - `preset` 'recommended' | 'strict' | 'report-only': Named baseline configuration
  - `config` object: Full security-headers config with hsts, csp, frameOptions, contentTypeOptions, referrerPolicy, permissionsPolicy, coop, coep, and corp fields

## Response `200`

Security headers generated

- SecurityHeadersGenerateResult
  - `headers` object[]: Ordered list of enabled headers
    - `name` string
    - `value` string
  - `outputs` object: Ready-to-paste configuration per server format
    - `nginx` string
    - `apache` string
    - `caddy` string
    - `cloudflare` string
    - `headers` string: Netlify/Vercel-style _headers file
    - `raw` string
  - `warnings` string[]

## Other responses

- `400`: Invalid body — provide a preset or a config

---

[API](https://skmtc.dev/intodns/apis/intodns-ai-api.md) · [All operations](https://skmtc.dev/intodns/apis/intodns-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/intodns/apis/intodns-ai-api/revisions/c6c196b2fb4c?raw)