Security headers are instructions your server gives the browser: which scripts may run, whether the page can sit inside an iframe, what information to pass on. A few lines of nginx configuration close whole classes of attacks on your visitors.
Content-Security-Policy is the strongest: it lists the origins from which the browser accepts scripts, styles, images and connections, which sharply limits the damage of XSS because an injected script is not allowed to run. X-Content-Type-Options: nosniff stops the browser guessing a file's type and executing something served as text. frame-ancestors, and its predecessor X-Frame-Options, stop other sites embedding yours in an iframe, the basis of clickjacking. Referrer-Policy controls how much of the URL leaves for other sites. Permissions-Policy switches off camera, microphone or geolocation.
The golden rule in nginx: add_header directives inside a location block replace the whole list inherited from the server block. Add one cache header in a location for images and the security headers vanish from those responses. The fix is an include file inside every block that has its own add_header. Add the always flag so the headers also appear on 4xx and 5xx responses. Write the CSP in report-only mode and watch it for a few weeks: inline scripts, external fonts and chat widgets all show up in the reports. Only then enforce it, using a nonce for inline scripts.
| Header | Recommended value | What it prevents |
|---|---|---|
| Content-Security-Policy | default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self' | XSS, resource injection, clickjacking |
| X-Content-Type-Options | nosniff | Executing files served with the wrong type |
| X-Frame-Options | SAMEORIGIN (for old browsers) | Clickjacking |
| Referrer-Policy | strict-origin-when-cross-origin | Leaking URLs that contain tokens |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Sensor access from compromised pages |
| Strict-Transport-Security | max-age=31536000; includeSubDomains (HTTPS only) | Downgrade to HTTP |
| Server | server_tokens off | Version fingerprinting for exploitation |
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report" always;server_tokens off;
server {
listen 443 ssl;
http2 on;
server_name example.ro;
include snippets/security-headers.conf;
location ~* \.(png|jpg|webp|css|js)$ {
expires 30d;
add_header Cache-Control "public, immutable";
include snippets/security-headers.conf; # otherwise the headers disappear here
}
location = /csp-report {
access_log /var/log/nginx/csp.log;
return 204;
}
}curl -sI https://example.ro/ | grep -iE "content-security|x-frame|x-content-type|referrer|permissions|strict-transport|^server"
curl -sI https://example.ro/missing-page | grep -i x-content-typeA script injected into a product review read the cookies of logged-in users. After the CSP was switched to blocking, with script-src limited to the shop's own domain, the script no longer executed, and the CSP reports named the affected page before any customer complained.
A third-party site embedded the login page in an invisible iframe above a 'download' button. frame-ancestors 'self' stopped the embedding. The check also showed the header was missing on /login because of a cache add_header in that location.
Only if you do not declare them. Each third-party service publishes the origins it needs for script-src, connect-src and frame-src. The report-only period exists for exactly this: the reports show which origins are missing from the policy. You add them explicitly instead of opening the policy with a wildcard.
frame-ancestors takes priority in every modern browser and is more flexible, since it allows several origins. Keep X-Frame-Options for old browsers; when both are present, a modern browser ignores X-Frame-Options. Having both does no harm.
The static ones, nosniff, Referrer-Policy, Permissions-Policy and frame-ancestors, belong in nginx so they also cover static files and error pages. A CSP with a per-request nonce has to be generated by the application, because the nonce changes with every response. Check both layers so you do not duplicate headers.
A production server starts getting attacked within minutes of receiving a public IP address, however small the project is. This guide ranks the controls by impact, from SSH access to incident response, with the Romanian rules that apply along the way. Every topic has its own page with a short answer, examples and ready-to-use configuration.