# HSTS and X-Frame-Options

**URL:** <https://www.ruby-forum.com/t/hsts-and-x-frame-options/235726>\
**Category:** NGINX\
**Created:** [July 11, 2013, 1:26pm UTC](https://www.ruby-forum.com/t/hsts-and-x-frame-options/235726 "2013-07-11T13:26:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\
**Post date:** [July 11, 2013, 1:26pm UTC](https://www.ruby-forum.com/t/hsts-and-x-frame-options/235726/1 "2013-07-11T13:26:23Z")

</div>

Hi,

I’ve just enabled HSTS and X-Frame Options in my nginx configuration  
(1.2.9) and was wondering if I have done it correctly.

Currently my site has 4 server blocks.

One to redirect [domain.com](http://domain.com) to [https://www.domain.com](https://www.domain.com)

One to redirect [www.domain.com](http://www.domain.com) to [https://www.domain.com](https://www.domain.com)

One to redirect [https://domain.com](https://domain.com) to [https://www.domain.com](https://www.domain.com)

And finally the main one for [https://www.domain.com](https://www.domain.com)

I’ve added the following two lines to the final server block:

|add\_header Strict-Transport-Security max-age=63072000;|

|add\_header X-Frame-Options DENY;

Do I need to add them to any of the other server blocks or is my current  
configuration  
correct? If there are any other improvements to be made I’d be more than  
happy to hear about them.

Thanks.  
|

---

<div class="post-metadata">

**Author:** ![newdude](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/aca169/32.png) [@newdude](https://www.ruby-forum.com/u/newdude)\
**Post date:** [July 11, 2013, 4:43pm UTC](https://www.ruby-forum.com/t/hsts-and-x-frame-options/235726/2 "2013-07-11T16:43:50Z")

</div>

On 11/07/13 12:25, Some D. wrote:

> Do I need to add them to any of the other server blocks or is my current  
> configuration  
> correct? If there are any other improvements to be made I’d be more than  
> happy to hear about them.
> 
> Thanks.

Hmm seems like my copy and paste job screwed with the text. These are  
the actual lines:

add\_header X-Frame-Options DENY;  
add\_header Strict-Transport-Security max-age=63072000;