How to Configure Modern HTTP Security Headers in Nginx and Apache (2026 Production Guide)

Why Defensive HTTP Headers Matter More Than Ever

When web application developers write code, their primary focus is frequently on feature delivery, database optimization, and responsive user interfaces. However, the client-side execution environment—the web browser—is inherently hostile. Browsers execute untrusted third-party scripts, follow redirects, parse complex DOM trees, and transmit sensitive cookies across sessions.

Without defensive response headers, browsers adopt permissive legacy defaults. An unconfigured web server will willingly render inside invisible `<iframe>` overlays (enabling Clickjacking), execute arbitrary scripts injected into URL parameters (enabling Cross-Site Scripting), and allow unencrypted HTTP fallback connections (enabling SSL-stripping Man-In-The-Middle attacks).

By deploying standardized HTTP security response headers, server administrators communicate security policies directly to browser engines before HTML parsing begins. This guide provides production-tested configurations for Nginx, Apache HTTP Server, and modern reverse proxies.

---

1. HTTP Strict Transport Security (HSTS)

What it does HTTP Strict Transport Security (`Strict-Transport-Security`) instructs browsers that the website must only be accessed using HTTPS. If a user manually types `http://example.com` or clicks a legacy unencrypted link, the browser automatically upgrades the connection to HTTPS locally (307 Internal Redirect) without transmitting an unencrypted request over the wire.

The Directive Syntax ```http Strict-Transport-Security: max-age=31536000; includeSubDomains; preload ```

• **`max-age=31536000`**: Specifies the duration in seconds that the browser must remember the HTTPS-only policy (31,536,000 seconds = 1 full year).
• **`includeSubDomains`**: Applies the rule to all current and future subdomains.
• **`preload`**: Authorizes inclusion in Google Chrome, Microsoft Edge, and Mozilla Firefox's hardcoded HSTS preload list built directly into browser binaries.

**Caution:** Do not include `includeSubDomains` until you have verified that every active subdomain possesses a valid TLS certificate. If an internal staging subdomain lacks HTTPS, enabling this directive will immediately make that subdomain inaccessible.

---

2. Content-Security-Policy (CSP)

What it does Content-Security-Policy is the single most powerful defense against Cross-Site Scripting (XSS), code injection, and data exfiltration. CSP restricts the domains from which scripts, stylesheets, fonts, and images can load, and completely disables inline execution unless cryptographically authorized with a nonce or SHA-256 hash.

Production Baseline Policy ```http Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https:; connect-src 'self' https://api.cybercheckindia.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; ```

Key Directives Explained * **`default-src 'self'`**: Sets the fallback behavior so that all undefined resource types (media, workers, objects) can only load from the origin domain. * **`object-src 'none'`**: Completely disables obsolete browser plugins (Flash, Java Applets, Silverlight). * **`base-uri 'self'`**: Prevents attackers from injecting a malicious `<base href="...">` tag to hijack relative URL resolutions. * **`frame-ancestors 'self'`**: Modern replacement for `X-Frame-Options`, specifying which parent pages may embed this site.

---

3. X-Frame-Options (Clickjacking Mitigation)

What it does Clickjacking (UI redressing) occurs when an attacker renders your login screen or financial transaction button inside a transparent `<iframe>` beneath an enticing game or prize button. The victim believes they are clicking the game, but their mouse event activates your hidden administrative button.

Standard Configuration ```http X-Frame-Options: SAMEORIGIN ``` * Use `DENY` if the site should never be embedded anywhere. * Use `SAMEORIGIN` if parent pages hosted on the exact same domain are permitted to frame the content.

---

4. X-Content-Type-Options (MIME Sniffing Prevention)

What it does Historically, when Internet Explorer and older browsers received a file without a MIME type or with an ambiguous type, the browser would inspect the raw byte array ("MIME sniffing"). If an image upload contained JavaScript characters (`<script>`), the browser would execute it as executable code.

X-Content-Type-Options: nosniff
```

---

5. Referrer-Policy and Permissions-Policy

Referrer-Policy Controls how much path and query string information is sent in the `Referer` HTTP header when users click outbound links: ```http Referrer-Policy: strict-origin-when-cross-origin ``` This policy transmits the full URL when navigating internally, but strips sensitive query parameters (like tokens or session IDs) when linking to external domains, transmitting only the origin (`https://cybercheckindia.com`).

Permissions-Policy Restricts web applications and embedded third-party iframes from accessing physical device hardware: ```http Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=() ```

---

Production Drop-In Snippets

Nginx Configuration (`/etc/nginx/conf.d/security-headers.conf`)

# Defensive HTTP Response Headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Suppress Version Disclosure server_tokens off; ```

Apache Configuration (`.htaccess` or `httpd.conf`)

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; object-src 'none';"
  Header unset X-Powered-By

ServerSignature Off ServerTokens Prod ```

---

Statutory Baseline: GIGW 3.0 & CERT-In

In India, implementing these headers is a mandatory statutory requirement. Under Chapter 9 of the **Guidelines for Indian Government Websites (GIGW 3.0)** and technical security advisories issued by **CERT-In**, government portals and public sector enterprises that fail to configure HSTS or expose server software versions via `Server` and `X-Powered-By` headers will fail formal STQC pre-certification testing.

Regularly test your staging and production environments using our free [Security Headers Analyzer](/tools/security-headers) to confirm verified A+ posture.