Security Headers

⚡ Built-in — Platform Built-in

Set the Referrer-Policy and Permissions-Policy response headers of this site, picked from a fixed list of safe values. Use it when a site must restrict browser features (camera, microphone, geolocation, payment, usb, display-capture, fullscreen, autoplay) or control what the Referer header reveals. Meta tags cannot do this. HSTS, X-Frame-Options and X-Content-Type-Options are set by the platform. Paid plans.

⚡ Built-in — No Setup Required This integration is built into the WebsitePublisher platform. All endpoints are available immediately — no API key needed.

Endpoints (2)

POST get-headers

Security header settings of this project: stored values, the effective Referrer-Policy and Permissions-Policy, the platform defaults and the allowed values.

No input parameters required.

POST set-headers

Change security headers; project owner only, never an admin session. referrer_policy: one of no-referrer, same-origin, strict-origin, strict-origin-when-cross-origin, no-referrer-when-downgrade. permissions_policy: object of feature => "none" (blocked everywhere) or "self" (this site only), e.g. {"camera": "none", "microphone": "none", "geolocation": "none"}; features not listed stay at the browser default. reset: setting names to put back to the platform default. Paid plans to set; reset works on every plan. A cached page shows the new headers once its cache is refreshed.

Field	Type	Required	Description
`referrer_policy`	string	No	Referrer-Policy value from the allowed list.
`permissions_policy`	array	No	Object of feature => "none" or "self".
`reset`	array	No	Setting names to put back to the default: referrer_policy, permissions_policy.

MCP Tool Names

When using this integration through an AI assistant (Claude, ChatGPT, Cursor, etc.), the endpoints are available as MCP tools:

Endpoint	MCP Tool Name
get-headers	`security-headers_get_headers`
set-headers	`security-headers_set_headers`

← Back to all integrations