# nginx Security Hardening

## Essential Headers

```nginx
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self';" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
```

Do NOT include X-XSS-Protection (deprecated, modern browsers removed XSS auditors, the header itself introduced vulnerabilities).

## TLS

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
```

Note: Let's Encrypt shut down OCSP in August 2025. Remove ssl_stapling directives if using LE certs.

## General

```nginx
server_tokens off;                    # hide version
client_body_buffer_size 1k;
client_header_buffer_size 1k;
client_max_body_size 1k;              # adjust per use case
large_client_header_buffers 2 1k;
```

## Mozilla SSL Config Generator

https://ssl-config.mozilla.org/

Three profiles: Modern (TLS 1.3 only), Intermediate (1.2+1.3), Old (legacy).
Server Side TLS docs: https://wiki.mozilla.org/Security/Server_Side_TLS

## References

- Checklist 2025: https://gixy.org/guides/nginx-hardening-checklist
- SecOps guide: https://www.secopsolution.com/blog/nginx-security-hardening-guide
- Best config gist: https://gist.github.com/plentz/6737338
- Linux Audit: https://linux-audit.com/web/nginx-security-configuration-hardening-guide/