Nginx Security Headers Generator
Generate a production-ready Nginx security headers configuration. This tool produces a tested, copy-paste nginx.conf snippet implementing all recommended security headers including HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
What is ?
Nginx is one of the most widely deployed web servers and reverse proxies in the world. Securing an Nginx deployment requires configuring the correct security headers in your server{} blocks. A properly configured Nginx security header setup takes under 5 minutes but defends against XSS, clickjacking, MIME sniffing, and SSL stripping attacks.
Why It Matters
Default Nginx installations include no security headers. The Server header even reveals "nginx" and the version number by default. A misconfigured or unprotected Nginx server is a common finding in penetration tests — and one of the easiest to fix. Industry standards including PCI-DSS, HIPAA technical controls, and ISO 27001 implicitly require the controls that security headers provide.
Common Configuration Mistakes
- ✗Adding headers in location{} blocks instead of server{} blocks (headers may not apply to all responses)
- ✗Forgetting "always" in add_header — headers are only sent on 2xx responses without it
- ✗Using proxy_hide_header only for specific backends and missing others
- ✗Not applying server_tokens off to remove the Nginx version from the Server header
- ✗Setting headers that conflict with upstream application-set headers
- ✗Not testing after configuration changes with curl -I or the scanner above
Recommended Configuration
server {
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; ..." always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
server_tokens off;
}Frequently Asked Questions
Do I need to reload Nginx after adding security headers?
Yes. Run: sudo nginx -t (to test configuration) then sudo nginx -s reload (to apply without downtime). Never apply untested configuration changes to production.
Where exactly do I add these headers in nginx.conf?
Add them inside the server{} block for HTTPS. For headers that should apply to all virtual hosts, you can add them in the http{} block. Headers in server{} override http{} block headers.
Why does "always" matter in add_header?
Without "always", Nginx only sends add_header values on 2xx and 3xx responses. Error pages (404, 500, etc.) won't get the headers. Using "always" ensures headers are sent on all response codes.
How do I remove the Nginx Server header?
server_tokens off; removes the version number. To remove the Server header entirely, you need the nginx_headers_more module: more_clear_headers Server;. Without this module, the best you can do is hide the version.
Related Tools & Guides
Need Professional Web Application Security Testing?
This scanner checks visible headers. VAPT Experts provides professional web application penetration testing, API security testing, and compliance-ready security reports.
Request VAPT Assessment