nginx-security.conf

# ── DMARC Viewer — Recommended Nginx Security Configuration ──
# Add this inside your server {} block in nginx.conf or site config.
# Provides security headers that complement the application-level headers.

# ── Security headers ──
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options    "nosniff"                                       always;
add_header X-Frame-Options           "DENY"                                          always;
add_header Referrer-Policy           "strict-origin-when-cross-origin"               always;
add_header Permissions-Policy        "geolocation=(), microphone=(), camera=()"      always;

# ── Content Security Policy ──
# Allows scripts only from self and cdnjs.cloudflare.com (where our CDN libs are served).
# If you move to self-hosted JS, remove the cdnjs entry and add 'nonce-{random}' instead.
add_header Content-Security-Policy "
  default-src 'self';
  script-src  'self' https://cdnjs.cloudflare.com;
  style-src   'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com;
  font-src    https://fonts.gstatic.com;
  connect-src 'self' https://ipwho.is https://ipapi.co;
  img-src     'self' data:;
  frame-src   'none';
  frame-ancestors 'none';
  base-uri    'self';
  form-action 'self';
" always;

# ── PHP file access restriction ──
# Only allow the three specific PHP endpoints, block all others.
location ~ \.php$ {
    # Whitelist only the specific files needed
    if ($uri !~ "^/(iplookup|spf-lookup|dkim-lookup)\.php$") {
        return 403;
    }
    # Standard PHP-FPM pass (adjust to your setup)
    fastcgi_pass   unix:/run/php/php8.2-fpm.sock;
    fastcgi_index  index.php;
    include        fastcgi_params;
    fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

# ── Block access to hidden files and sensitive paths ──
location ~ /\. {
    deny all;
    return 404;
}

# ── Rate limiting ──
# Define rate limit zones (place in http {} block, above server {})
# limit_req_zone $binary_remote_addr zone=dmarc_api:10m rate=30r/m;
# Then inside location blocks for PHP:
# limit_req zone=dmarc_api burst=10 nodelay;

# ── Cache static files ──
location ~* \.(html|css|js|woff2?)$ {
    expires 1h;
    add_header Cache-Control "public, must-revalidate";
}