For header audits I check HSTS only on HTTPS server blocks, keep CSP report-only first, and confirm nginx is not stripping headers set by the app via proxy_hide_header mistakes.
Thanks, that's a solid checklist. One more nginx gotcha that bites a lot of header audits: add_header directives are only inherited from the parent level if the current location block defines none of its own, so adding a single header inside a location can silently drop HSTS and CSP set at the server level. Adding the always flag also matters, otherwise the headers are skipped on 4xx and 5xx responses. Running curl -I against a few error pages as well as the homepage catches both.
Good catch on the inheritance trap — that one has bitten me more than once. I keep security headers in a single included snippet now so no location ever redefines add_header, and I always pair them with the always flag. One extra audit step that helps: after the homepage and error-page curl -I sweep, hit a 301/302 path too — some setups only attach headers on the final 200 and leave the redirect itself bare.
Edge Ops
For header audits I check HSTS only on HTTPS server blocks, keep CSP report-only first, and confirm nginx is not stripping headers set by the app via proxy_hide_header mistakes.