# How to add custom HTTP headers

Add your own HTTP response headers - most often security headers - with a small piece of custom
Nginx configuration.

## Before you start

- **SSH access to the host** - see [SSH access](../../platform/hosts/ssh.md).
- Add the headers in `~/nginx/50main.conf` - see [custom Nginx configuration](configure.md#custom-nginx-configuration).

## Add security headers

In the server block (or a `location`), use `add_header` with the `always` flag so the header is sent
on error responses too:

```nginx
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
```

> [!IMPORTANT]
> If you add `add_header` inside a `location`, Nginx stops inheriting the headers set higher up - you
> must repeat the ones you still want in that location.

## Restrict access to text and log files

A common hardening rule: allow `robots.txt`, but deny other `.txt` and `.log` files.

```nginx
location = /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
}
location ~* \.(txt|log)$ {
    deny all;
}
```

## Apply and verify

```bash
tscli nginx reload
```

Check the headers with:

```bash
curl -I https://example.com
```

> [!TIP]
> To make browsers always use HTTPS, add the `Strict-Transport-Security` (HSTS) header - but only
> once HTTPS works everywhere, because it is hard to undo. See [Force HTTPS](force-https.md).

## Related

- [Configure Nginx](configure.md)
- [Force HTTPS](force-https.md)
- [Security hardening](../../concepts/security-hardening.md)