What security rules does this Nginx linter check?

It checks for insecure SSL protocols (TLSv1.0/1.1), missing HSTS and X-Frame-Options headers, proxy_pass trailing slash URL rewriting traps, missing server_tokens off, and missing PHP SCRIPT_FILENAME parameters.

Is my server configuration uploaded anywhere?

No. The inspection runs purely client-side using JavaScript regexes and a custom lexical analyzer. Your confidential IPs, domain names, and proxy targets never leave your browser.

Nginx Configuration Linter & Security Auditor

Audit your nginx.conf for critical security vulnerabilities, proxy_pass path traversal bugs, deprecated SSL ciphers, and performance misconfigurations. 100% private and client-side.

Security Score 100%

Errors 0

Warnings 0

Optimizations 0

NGINX CONFIGURATION INPUT 0 lines

AUDIT FINDINGS & ADVICE 0 findings

Click "Lint Config" or load a sample to inspect directives.

Frequently Asked Questions

What is the common Nginx proxy_pass trailing slash trap?

When a location block does not have a trailing slash (e.g. location /api) but the proxy_pass directive does have one (e.g. proxy_pass http://upstream/;), Nginx performs URI normalization that strips the matching prefix. This frequently introduces off-by-slash path traversal security flaws.

Why should server_tokens be turned off?

By default, Nginx emits its exact version number in the Server HTTP response header and default error pages. Disabling it with server_tokens off; prevents automated scanners from identifying unpatched CVEs.

Is this linter suitable for production servers?

Yes! It incorporates CIS Nginx Benchmark recommendations, Mozilla SSL configuration guidelines, and OWASP web server hardening best practices.