← Back to Blog tutorial

Security Headers in 15 Minutes: Copy-Paste Configurations for Nginx, Apache, and Cloudflare

· 2 min read
Security Headers Nginx Apache Cloudflare Tutorial

Security headers are the most underrated quick win in web security. Most websites get a C or D grade — not for technical reasons, but because the headers were simply never configured. Here are the server configurations you can copy directly.

Complete Nginx Configuration

Add the following to your server {} block:

server {
    add_header Strict-Transport-Security
        "max-age=63072000; includeSubDomains; preload" always;

    add_header Content-Security-Policy
        "default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" always;

    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy
        "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy
        "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    add_header Cross-Origin-Embedder-Policy "require-corp" always;
}

Complete Apache Configuration

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; frame-ancestors 'self'"
    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()"
    Header always set Cross-Origin-Opener-Policy "same-origin"
</IfModule>

Cloudflare: Transform Rules

  1. HSTS: Use SSL/TLS → Edge Certificates → Enable HSTS (recommended over Transform Rules)
  2. All other headers: Create one “Set static” rule per header under Rules → Transform Rules → Modify Response Header

The CSP Trap: Why You Can't Just Copy-Paste

Content-Security-Policy is the one header you should not blindly copy. Every website has different resources (CDNs, Google Fonts, analytics, payment providers). A too-strict CSP breaks your site.

Recommended workflow:

  1. Start with Content-Security-Policy-Report-Only
  2. Open browser console and check which resources would be blocked
  3. Add required domains to the policy
  4. After 1–2 weeks without violations: switch to enforcing Content-Security-Policy

Warning: Remove X-XSS-Protection!

If you're setting X-XSS-Protection: 1; mode=block: remove it. Current research (Khodayari & Pellegrino, WWW 2026) shows the XSS auditor in Chromium can itself be exploited as an attack vector. Correct: X-XSS-Protection: 0 or omit the header entirely. A strong CSP is the proper XSS protection.

Verify Your Result

After deployment: Run a free Light-Check — the header grade updates immediately. Which headers we check and how we score them is documented on the methodology page.

This article was produced with AI assistance and fact-checked against verified GDPR case law (GDPRhub). For legal advice, consult a qualified data protection expert.

Related Articles