Hosting nodes send no security headers (client sites grade F)

FeatureOpenView on roadmap· 13 days ago

Imported from GitHub issue El-SaMa/oma#211 by @El-SaMa.

Arx Site Check / HTTP Headers tool: maxfort.fi and niletech.fi (nilek) get grade F: no HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options. Our own tool marks our customers "medium risk".

Do: a safe default header set in the node nginx config (not CSP, which breaks sites): HSTS (only for sites with valid certs), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN, a conservative Permissions-Policy, server_tokens off. Work with Enhance (no hand-edited vhosts that Enhance overwrites; see handbook nginx-node-hardening). Arx rule: nilek first, review, then fleet after operator OK. Verify with https://lanedns.lanetti.fi/tools/http-headers/

Context (2026-10-14): lanedns.lanetti.fi (Lanetti Tools, standalone PHP site on nilek, repo El-SaMa/lanedns site/) was revamped and OMA became its control plane: usage in /admin/tools/usage, settings in /admin/tools/settings, staff MCP oma.admin_lanetti_tools, config pull GET /api/lanetti-tools/config (link token in LaneDNS storage/oma-link.php). Events: site_events site lanedns.lanetti.fi, tool_run sanitized by services/core-api/src/lanetti-tools/usage-events.ts. Read handbook hosting/netspeed section "OMA is the control plane" and .cursor/rules/lanedns-standalone.mdc (deploy recipe: keep public_html group www-data) before touching LaneDNS.

Comments (0)

No comments yet.

Join the discussion