使用安全标头强化 Nginx

Beyond TLS and authentication, modern browsers honor security headers that instruct them how to behave. Nginx can inject these on every response with the add_header directive.

X-Content-Type-Options: nosniff stops browsers from guessing a resource's type, blocking attacks that disguise a script as an image.

X-Frame-Options controls whether your site can be embedded in a frame. Use DENY or SAMEORIGIN to prevent clickjacking.

HSTS forces browsers to use HTTPS for future visits. Set a long max-age once HTTPS is stable everywhere.

A Content-Security-Policy restricts where scripts, styles, and other resources may load from, mitigating cross-site scripting.

Referrer-Policy limits how much referrer information leaks to other sites when users click outbound links.

Without always, Nginx adds the header only on successful responses (2xx, 3xx). The always flag ensures the header is present on error responses too.

By default Nginx reveals its version in the Server header and error pages. Turn this off to give attackers less information.

If a location block has its own add_header, it replaces all inherited headers from the parent. Re-declare needed headers in nested blocks.

Keep all security headers in one include file and pull it into each server block for consistency.

Use curl to inspect the response headers and confirm each one is present, even on error responses.

You hardened Nginx with browser security headers:

• nosniff blocks MIME confusion
• X-Frame-Options stops clickjacking
• HSTS enforces HTTPS, CSP restricts resources
• Use always and beware add_header inheritance
• server_tokens off hides the version

These complement TLS and authentication for defense in depth.