Security options, headers, ciphers, and TLS settings.

====================================================================================

Security Options and Headers

------------------------------------------------------------------------------------------------------------------------------------------------

SSL/TLS Settings

Define SSL certificate in vhost:

ssl_certificate /etc/nginx/ssl/your-domain.com.crt;
ssl_certificate_key /etc/nginx/ssl/your-domain.com.key;

Enable TLS 1.2 and 1.3:

ssl_protocols TLSv1.2 TLSv1.3;

Force usage of ciphers in order of most secure to least:

ssl_prefer_server_ciphers on; 

Define SSL ciphers for nginx to use:

ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';

====================================================================================

Headers

------------------------------------------------------------------------------------------------------------------------------------------------

HSTS

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking.. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol.

HSTS can be enabled globally in the nginx.conf file, or on a per site bases.

add_header Strict-Transport-Security "max-age=63072000; includeSubdomains;"

------------------------------------------------------------------------------------------------------------------------------------------------

X-Content-Type-Options

Prevents MIME-sniffing attacks where browsers may override the declared content type of a resource.

nosniff: Instructs the browser not to sniff the MIME type and to use the content type as declared in the Content-Type header.

add_header X-Content-Type-Options "nosniff" always;

------------------------------------------------------------------------------------------------------------------------------------------------

X-Frame-Options

Prevents clickjacking attacks by controlling whether your site can be embedded in a frame or iframe.

DENY: Prevents any site from framing your content.

SAMEORIGIN: Allows framing only from the same origin.

add_header X-Frame-Options "DENY" always;

------------------------------------------------------------------------------------------------------------------------------------------------

X-XSS-Protection

add_header X-XSS-Protection "1; mode=block" always;

add_header Referrer-Policy "no-referrer-when-downgrade" always;