Secure Nginx configuration

In this post, I would like to share secure Nginx configuration.

🐰 nginx.conf

# Don't send the nginx version number in error pages and Server header
server_tokens off;

# Don't allow the browser to render the page inside an frame or iframe and avoid clickjacking
add_header X-Frame-Options SAMEORIGIN;

# When serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header, to disable content-type sniffing on some browsers.
add_header X-Content-Type-Options nosniff;

# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
add_header X-XSS-Protection "1; mode=block";

# With Content Security Policy (CSP) enabled(and a browser that supports it,
# you can tell the browser that it can only download content from the domains you explicitly allow
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-src; object-src 'none'";

# redirect all http traffic to https
server {
listen 80 default_server;
listen [::]:80 default_server;
return 301 https://$host$request_uri;

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;

ssl_certificate /etc/nginx/ssl/example_com.crt;
ssl_certificate_key /etc/nginx/ssl/example_com.key;

# Enable session resumption to improve https performance
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_session_tickets off;

# Enables server-side protection from BEAST attacks
ssl_prefer_server_ciphers on;

# Disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

# Ciphers chosen for forward secrecy and compatibility

# Enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/star_forgott_com.crt;

# Config to enable HSTS(HTTP Strict Transport Security)
# to avoid ssl stripping
# also
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

# ... the rest of your configuration

🐞 Special Thanks

🖥 Recommended VPS Service

VULTR provides high performance cloud compute environment for you. Vultr has 15 data-centers strategically placed around the globe, you can use a VPS with 512 MB memory for just $ 2.5 / month ($ 0.004 / hour). In addition, Vultr is up to 4 times faster than the competition, so please check it => Check Benchmark Results!!