Sign up free
Precision-built server with three removable modules and evenly spaced ventilation holes
Managed-hosting comfort on servers you own.See pricing
A machined control panel: CONTROL
Search every capability.All features
A globe beside a compact provider server
Compare providers, plans and prices.Compare providers
Source and target modules joined by a continuous connector
Cloudflare, Git, storage, AI agents and alerts.All integrations

Set response headers

Updated October 7, 2026 · 1 min read

Choose the security and policy headers a static site, PHP site or Node.js app sends with every page and file, such as a Content Security Policy.

On this page
  1. Step 1: Open the headers
  2. Step 2: Add, change or remove headers
  3. Step 3: Save the headers
  4. Rules for headers

Before you start

  • A static site, PHP site or Node.js app that has been deployed at least once.
  • Permission to manage sites in your Nuvlo account.

Step 1 Open the headers

Open the site from Sites, click the Security tab and then Headers. Nuvlo reads the current headers from the server. A new site sends these by default:

HeaderDefault value
Strict-Transport-Securitymax-age=15552000
X-Content-Type-Optionsnosniff
X-Frame-OptionsSAMEORIGIN
Referrer-Policystrict-origin-when-cross-origin

Step 2 Add, change or remove headers

Click Add header. Type the name; common ones such as Content-Security-Policy, Permissions-Policy or Cross-Origin-Opener-Policy are suggested as you type. Enter the value.

Edit a value in place, or click the bin to remove a header. Removals take effect when you save.

If a Content-Security-Policy sets frame-ancestors, browsers ignore X-Frame-Options, and Nuvlo suggests removing it.

Step 3 Save the headers

Click Save headers to the site. The site sends the new headers right away; no redeploy is needed.

To go back to the defaults, click Use Nuvlo's default headers and save.

Rules for headers

  • Up to 25 headers per site, each value up to 4,096 characters.
  • Names use letters, numbers and dashes. Each name can appear once.
  • Values can't contain $ or \, and can use either single or double quotes, not both.
  • Headers set by the server or the app can't be changed here, for example Cache-Control, Content-Type, Set-Cookie, Location or Server.

WordPress sites manage their security headers with the Security headers switch on their Security tab instead.