nginx

TXT
# 1. HSTS
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# 2. Strict Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; style-src 'self'; img-src 'self' data:; font-src 'self' data: https://gstatic.com; frame-ancestors 'self'; form-action 'self';" always;

# 3. Base Security Headers
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# 4. Modern SSL Ciphers (Fix for LUCKY13)
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
ssl_prefer_server_ciphers on;

Verwende Code mit Vorsicht.

Step 2: Fix Cookies via Custom php.ini Settings

Instead of relying on Nginx to modify your application's cookies, force the PHP engine to issue them securely from the start.

  1. In the same Sites settings page in ISPConfig, look right above the Nginx box for the field labeled Custom php.ini settings.
  2. Paste the following configuration lines into it:

ini

TXT
session.cookie_secure = On
session.cookie_httponly = On
session.cookie_samesite = "Lax"