nginx.md

Secure nginx

Global resource: webdock.io

• Disable server tokens

  server_tokens off;

• Content Security Policy Reference

  add_header Content-Security-Policy "default-src 'self';" always;

• X-frame-options

  add_header X-Frame-Options SAMEORIGIN always;

• X-Xss-Protection: block

  add_header X-Xss-Protection "1; mode=block" always;

• strict origin

  add_header Referrer-Policy "strict-origin" always;

• Permissions Policy

  add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()";

• Content sniffing

  add_header X-Content-Type-Options nosniff always;