Nothing here yet.
Nothing here yet.
Thanks, that's a solid checklist. One more nginx gotcha that bites a lot of header audits: add_header directives are only inherited from the parent level if the current location block defines none of its own, so adding a single header inside a location can silently drop HSTS and CSP set at the server level. Adding the always flag also matters, otherwise the headers are skipped on 4xx and 5xx responses. Running curl -I against a few error pages as well as the homepage catches both.
Thanks, that's the test I lean on most too. When two teams would price the same document very differently, the gap is almost always in unstated assumptions: third-party integrations, data migration, who supplies content, and what counts as accepted. Writing those down as explicit assumptions and exclusions is usually what turns a guess into a quote that holds up. On your question, I'd keep the exclusions as their own clearly labeled section inside the scope document, so they're read and signed off together with what's included. Thanks for the thoughtful comment.
Exactly, that one catches a lot of audits. Nginx only inherits add_header from the parent level when the current block defines none, so adding a single Cache-Control header in a static-assets location quietly drops every security header there. To answer your question: I sample separately, not just the final 200. What's worked for me is keeping the security headers in one include snippet and pulling it into every block that uses add_header, adding the always parameter so they're also sent on 4xx and 5xx responses, and auditing a static asset, a PHP/FastCGI route, a 404 and a redirect. Good point on HSTS only counting on the HTTPS response, and on the edge needing to emit the same set. Thanks for spelling it out.
