0Pricing
API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) · Lesson

Hardening Nginx with Security Headers

Add HTTP security headers in Nginx to defend against clickjacking, MIME sniffing, and content injection attacks.

Hardening Nginx with Security Headers is a free API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Headers as a Defense Layer

Beyond TLS and authentication, modern browsers honor security headers that instruct them how to behave. Nginx can inject these on every response with the add_header directive.

Preventing MIME Sniffing

X-Content-Type-Options: nosniff stops browsers from guessing a resource's type, blocking attacks that disguise a script as an image.

add_header X-Content-Type-Options "nosniff" always;

Blocking Clickjacking

X-Frame-Options controls whether your site can be embedded in a frame. Use DENY or SAMEORIGIN to prevent clickjacking.

add_header X-Frame-Options "SAMEORIGIN" always;

Strict Transport Security

HSTS forces browsers to use HTTPS for future visits. Set a long max-age once HTTPS is stable everywhere.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Content Security Policy

A Content-Security-Policy restricts where scripts, styles, and other resources may load from, mitigating cross-site scripting.

add_header Content-Security-Policy "default-src 'self'" always;

Controlling the Referrer

Referrer-Policy limits how much referrer information leaks to other sites when users click outbound links.

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Why the always Flag

Without always, Nginx adds the header only on successful responses (2xx, 3xx). The always flag ensures the header is present on error responses too.

add_header X-Frame-Options "DENY" always;

Hiding the Nginx Version

By default Nginx reveals its version in the Server header and error pages. Turn this off to give attackers less information.

server_tokens off;

The add_header Inheritance Trap

If a location block has its own add_header, it replaces all inherited headers from the parent. Re-declare needed headers in nested blocks.

# headers in http/server are dropped here
location /api {
    add_header X-Content-Type-Options "nosniff" always;
}

Grouping Security Headers

Keep all security headers in one include file and pull it into each server block for consistency.

# security_headers.conf
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# server block:
include /etc/nginx/security_headers.conf;

Verifying Headers

Use curl to inspect the response headers and confirm each one is present, even on error responses.

curl -I https://example.com

Quick Check

Which header tells the browser to refuse loading your site inside a frame on another domain?

Recap

You hardened Nginx with browser security headers:

  • nosniff blocks MIME confusion
  • X-Frame-Options stops clickjacking
  • HSTS enforces HTTPS, CSP restricts resources
  • Use always and beware add_header inheritance
  • server_tokens off hides the version

These complement TLS and authentication for defense in depth.

Frequently asked questions

Is the “Hardening Nginx with Security Headers” lesson free?

Yes — the full text of “Hardening Nginx with Security Headers” is free to read here on the web, and the API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) course, upgrade to CoddyKit PRO.

What will I learn in “Hardening Nginx with Security Headers”?

Add HTTP security headers in Nginx to defend against clickjacking, MIME sniffing, and content injection attacks. You practise API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)?

No prior experience is required. API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Hardening Nginx with Security Headers” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) lesson?

Yes. Every API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Securing Nginx with SSL/TLS
  2. HTTP/2 & Nginx Optimization
  3. Basic Authentication & Access Control
  4. Hardening Nginx with Security Headers
← Back to API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)