Build the Security Headers Your Site Should Send
Tick what applies, fill in the hosts your page really loads from, and the block on the right rewrites itself for the server you pick. Start from a preset and change what differs.
How to Roll These Out Without Breaking the Site
Everything except the CSP is safe to deploy in one go: nosniff, framing, Referrer-Policy and Permissions-Policy have no visible effect on a site that is not doing something odd. HSTS is safe when every page and subdomain already works over HTTPS; test it with the five-minute max-age first, because a wrong HSTS is remembered by every visitor's browser until it expires. The CSP is the one that breaks things, always in the same way: an inline script, a third-party tag or a font host you forgot. Deploy it as report-only, open the browser console on every page type, add what it complains about, and only then switch to enforcing.
The strict preset uses nonces, which means your server has to generate a random value per response and put it on every script tag as nonce="...". That is the strongest policy and the one Google recommends, but it needs code changes; the other presets use host lists and work with static files. Paste the output, deploy, and run the checker against the live site to confirm the headers arrived intact; CDNs and reverse proxies sometimes drop or duplicate them.