add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self';" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
Do NOT include X-XSS-Protection (deprecated, modern browsers removed XSS auditors, the header itself introduced vulnerabilities).
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
Note: Let's Encrypt shut down OCSP in August 2025. Remove ssl_stapling directives if using LE certs.
server_tokens off; # hide version
client_body_buffer_size 1k;
client_header_buffer_size 1k;
client_max_body_size 1k; # adjust per use case
large_client_header_buffers 2 1k;
https://ssl-config.mozilla.org/
Three profiles: Modern (TLS 1.3 only), Intermediate (1.2+1.3), Old (legacy). Server Side TLS docs: https://wiki.mozilla.org/Security/Server_Side_TLS