Skip to content

Instantly share code, notes, and snippets.

@raco

raco/nginx_security_headers

Last active June 25, 2018 23:02
Show Gist options
  • Save raco/924714c802f0a0a697c053049e5c2184 to your computer and use it in GitHub Desktop.
Save raco/924714c802f0a0a697c053049e5c2184 to your computer and use it in GitHub Desktop.
Download ZIP
Nginx Security Headers
Raw
nginx_security_headers
# Security headers
add_header Strict-Transport-Security "max-age=2592000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header Content-Security-Policy "default-src 'self' www.google-analytics.com ajax.googleapis.com www.google.com google.com gstatic.com www.gstatic.com connect.facebook.net facebook.com;";
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "origin";
#https://developer.mozilla.org/es/docs/Web/HTTP/Headers/X-Frame-Options
#https://developer.mozilla.org/es/docs/Web/HTTP/Headers/X-Content-Type-Options
#https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff#_=_
#https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
#https://developer.mozilla.org/es/docs/Web/HTTP/Headers/X-XSS-Protection
#https://developer.mozilla.org/es/docs/Web/HTTP/Headers/Referrer-Policy
#https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment