Hardening nginx for a Static Site

A static site is already a strong security baseline: no database, no dynamic code execution, no auth surface. The remaining job is to make nginx send the right headers and avoid leaking information.

TLS

Pin modern protocols and let the client pick the cipher:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

If you serve publicly on 443, redirect all port 80 traffic to HTTPS and reject tunneling attempts:

server {
    listen 80 default_server;
    if ($request_method = CONNECT) { return 405; }
    location / { return 301 https://$host$request_uri; }
}

Information disclosure

Turn off the version banner so attackers don’t get a free fingerprint:

server_tokens off;

Static-site headers

Only apply these to your site locations, never to reverse-proxy blocks that forward to a panel — the upstream may set its own headers:

add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Frame-Options "SAMEORIGIN" always;

Takeaway

Static + sane headers + server_tokens off gets you most of the way. Reserve more aggressive CSP rules for when you’ve audited every asset the site loads.