How to add security headers on nginx

Six HTTP response headers cover the standard hardening checklist. Below: what each one does (honestly — one of them is already the browser default), then the exact nginx configuration.

The headers, and what they actually buy you

Strict-Transport-Security — max-age=31536000; includeSubDomains

Tells browsers to only ever use HTTPS for this domain (for 1 year). ⚠ includeSubDomains applies the rule to EVERY subdomain — any HTTP-only subdomain (an old intranet host, a device panel) becomes unreachable until the max-age expires; drop that token if you have one. Only meaningful on HTTPS responses — browsers ignore it over HTTP (RFC 6797). Add the preload token only deliberately: preloading is hard to undo (hstspreload.org).

X-Content-Type-Options — nosniff

Stops browsers from guessing content types — the only valid value.

X-Frame-Options — DENY

Blocks your site from being framed (clickjacking). The modern replacement is CSP frame-ancestors; keeping X-Frame-Options alongside covers older browsers. Use SAMEORIGIN instead if your site frames itself.

Referrer-Policy — strict-origin-when-cross-origin

This is already the browser default — setting it makes your policy explicit rather than fixing a hole. Use no-referrer for the strictest option.

Permissions-Policy — camera=(), microphone=(), geolocation=()

Disables powerful browser features your site doesn't use. Minimal sane starting set; extend with more features as needed.

Content-Security-Policy — (not copy-pasteable — start with Content-Security-Policy-Report-Only)

CSP is site-specific: a canned policy breaks any third-party script or style you load. Start with Content-Security-Policy-Report-Only to observe violations without breaking anything, then tighten into an enforced policy.

On nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

nginx gotchas worth knowing

• ⚠Keep the always flag: without it, nginx only adds headers to a fixed set of success/redirect status codes — your 404 and error pages would miss them.
• ⚠The classic nginx trap (from nginx's own docs): add_header directives are inherited from the parent level ONLY if the current block has none. A single add_header inside a location { } silently drops every parent-level security header — repeat the full set in any block that adds its own.
• ⚠Run nginx -t, then reload (nginx -s reload) to apply.

Verified against nginx: ngx_http_headers_module on 2026-07-12.