Processed locally in your browser — not uploaded
Nginx Config Security Analyzer
Analyze your Nginx server configuration for security risks. Calculates a 0–100 Security Rating, highlights missing HTTP headers (HSTS, CSP, X-Frame-Options), flags information leaks (server_tokens on), detects insecure TLS versions, and provides copyable fixed configuration snippets. Runs 100% locally in your browser.
`server_tokens on;` leaks your exact Nginx version in HTTP response headers and error pages.
Without HSTS, browsers may attempt initial unencrypted HTTP connections, opening users to SSL stripping attacks.
Your site can be embedded inside external iFrames, exposing users to clickjacking attacks.
Browsers might try to guess content types, potentially executing user-uploaded files as scripts.
Allowing PHP execution inside user upload directories enables Remote Code Execution (RCE) attacks if a malicious file is uploaded.
Allowing all origins to make cross-domain API requests can expose sensitive data to unauthorized third-party domains.
server {
listen 443 ssl http2;
server_name example.com www.example.com;
# Hide Nginx version
server_tokens off;
# Modern TLS configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
# Security Headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
# Block PHP execution in upload folders
location ~* /(uploads|files|wp-content/uploads)/.*\.php$ {
deny all;
}
location / {
root /var/www/html;
index index.html;
}
}How to use
- Paste your nginx.conf file content or server block into the code editor.
- Review your calculated Security Health Rating (A+ to F).
- Inspect flagged security warnings categorized by severity (Critical, Warning, Info).
- Copy the auto-generated hardened Nginx configuration template.
Understanding the output
The analyzer scans your Nginx configuration directives for common security vulnerabilities including information disclosure (server_tokens), missing HTTP security headers (HSTS, CSP, X-Frame-Options), insecure TLS protocols, and unsafe PHP execution in public upload folders.
Common issues & tips
- •Adding HTTP headers twice in Nginx (e.g. at both the http block and location block level) causes header duplication. Nginx add_header directives in a location block override all add_header directives in parent blocks.
- •Ensure your Nginx server block contains valid syntax by testing with `nginx -t` on your target server.
Frequently asked questions
- Is my Nginx configuration sent to a server?
- No. Analysis is performed entirely in your browser. Nothing is uploaded or logged.
- Why is server_tokens on dangerous?
- It exposes your exact Nginx version in HTTP response headers, helping automated vulnerability scanners target known exploits for that specific build.