Resolved How to add HTTP Security Header on port 80?

[adocsys]

Server operating system version

Almalinux 9.2

Plesk version and microupdate number

18.0.59

Hello,

Currently setting up a server to be PCI compliant and after multiple configuration adjustments, I only have one thing left to correct to have certification. I have set the HTTP Security Headers on all ports but I am not finding the port 80 configuration.

If I test the following, here are the results:

curl -sIL http://host.domain.ext:80
# Does not show any of the security headers, for example, x-content-type-options: nosniff

curl -sIL https://host.domain.ext:443
# Shows all my security headers, including x-content-type-options: nosniff

I have searched thru the files in /etc/sw-cp-server/ because it is Nginx that answers the call (I see header Server: nginx and netstat shows nginx process listening on port 80) but I am unable to find where I can add the directive.

The /etc/sw-cp-server/conf.d/plesk.conf file already contains the directives under the server tag and works fine for multiple ports but not port 80 sadly...

Has someone already done this or have a clue where the headers should be added?

Thanks a lot!

 

[adocsys]

Oh! I think I finally found. I needed to go play a game of hockey to have my head to stop thinking.

I simply edited the /etc/nginx/nginx.conf file and added the directives in the http section. Now I see the new headers on port 80. Will re-launch PCI certification scan and let you guys know in the morning as it takes over an hour to complete the scan.

Mathieu.

 

[Peter Debik]

I simply edited the /etc/nginx/nginx.conf file and added the directives in the http section.

Better remove it from there and instead create a separate configuration file in /etc/nginx/conf.d/ for it, because that will not be overwritten on the next update.

 

[adocsys]

Hello Peter,

First, hurray, I passed PCI Scanning. It was easier than expected, I had already did a great job before the first scan it seems. I only had 4 things to fix and the 3 others I already knew how to fix them. Seems my experience over the years is paying off.

Yes, I figured that would happen (change to be overwritten by the next update) and will look into creating an additional conf file specifically for my modifications. Thanks for the reminder, it's appreciated.

Mathieu.