Nginx WordPress Security headers

Community Support Web
1

How I can add additional security headers?

P.S. - I cannot use $HOMEDIR/$user/conf/web/$domain/nginx.hsts_custom.conf as it break the site.

# BEGIN Security Headers
server {
  # Basic Security headers
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
  add_header Content-Security-Policy "upgrade-insecure-requests"
  add_header X-Frame-Options "SAMEORIGIN"
  add_header X-Content-Type-Options "nosniff"
  add_header Referrer-Policy "strict-origin-when-cross-origin"
  add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), focus-without-user-activation=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), sync-script=(), trust-token-redemption=(), window-placement=(), vertical-scroll=()"
}
# END Security Headers
2

Remove:

# BEGIN Security Headers
server {


}

But leave everything else

3

Thanks, but it not works.

STEPS

  1. I uncheck in GUI “Enable HTTP Strict Transport Security (HSTS)”
  2. I launch nano $HOMEDIR/$user/conf/web/$domain/nginx.hsts_custom.conf (obviously with my data) and add
` add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

add_header Content-Security-Policy "upgrade-insecure-requests"

add_header X-Frame-Options "SAMEORIGIN"

add_header X-Content-Type-Options "nosniff"

add_header Referrer-Policy "strict-origin-when-cross-origin"

add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), focus-without-user-activation=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), sync-script=(), trust-token-redemption=(), window-placement=(), vertical-scroll=()"`
  1. Reboot
  2. WordPress site is on, but https://securityheaders.com not detect changes.

Are you sure (or I did some mistake)?

4

nginx.conf_hsts_custom

If I am right

5

NOPE. It break also WP site.

6

nginx.conf_*;

Format should be correct

Any errors?

7

YEAP.

  1. I do nano nginx.conf_hsts_custom
  2. To simplify (avoid possible syntax error) I add ONLY Hestia original syntax
add_header Strict-Transport-Security "max-age=15768000;" always;
  1. Reboot
  2. On https://securityheaders.com is still unrecognized change,

P.S. - if we can do it, I agree to send you on private messaging credentials and data to check yourself.

8

I have a file which I created called
/home/user/conf/web/domain.com/nginx.conf_security
It contains eg.

add_header Set-Cookie "Path=/; HttpOnly; Secure";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy "strict-origin";

Run nginx -t to check for errors.
Then systemctl restart nginx
The headers are detected correctly.

1 Like
9
  1. There was errors in syntax (now fixed and test passed well).
  2. On https://securityheaders.com is still unrecognized change.

Any idea what could be wrong?

10

All I can think of is if you have a proxy in between your website and securityheaders.com which is re-writing the headers. Cloudflare? Some other CDN?

11

NOPE. I’m on Oracle 4 x 24 ARM free tier and I thought that could be some issue in server installation, so I deleted instance. Per moment is issue that Oracle per moment not allow me vs capacity in domain (Ashburn, on free tier cannot be changed).

So, I will be back when I install it again and try again.

P.S. - Let topic open.

12

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.