Web Server Checks

Eight checks examine HTTP response headers, server behaviour, and nginx configuration files.

WS-HSTS-001 — HSTS Header

What it checks: Verifies the Strict-Transport-Security header is present with max-age of at least 31,536,000 seconds (one year), as recommended by the OWASP HSTS Cheat Sheet.

Auto-fix applies:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

WS-SEC-001 — Security Headers

What it checks: Presence of X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, and Referrer-Policy. Two or more present returns PASS.

Auto-fix applies:

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

WS-TLS-001 — TLS Configuration

What it checks: Verifies HTTPS is active and TLS is in use. The urllib3 HTTP adapter does not expose cipher-level details through its public API, so the check uses a pragmatic heuristic: if the target responds over HTTPS, TLS 1.2+ is confirmed (modern nginx/Apache defaults). Manual verification with openssl s_client is recommended for environments requiring specific cipher suite validation.

Note. Run --dry-run first when applying TLS fixes. The auto-fix is aware of Let’s Encrypt configurations and avoids overwriting Certbot-managed TLS settings.

WS-SRV-001 — Server Token Disclosure

What it checks: Examines the Server response header. Server: nginx/1.24.0 (Ubuntu) returns FAIL. Server: nginx returns PASS.

Auto-fix applies:

server_tokens off;

WS-DIR-001 — Directory Listing

What it checks: Probes six paths (/static/, /uploads/, /images/, /files/, /media/, /assets/) for directory listing signatures across nginx, Apache, Python SimpleHTTPServer, and IIS.

Early abort: Stops probing after two consecutive connection timeouts to prevent excessive scan duration on shared hosting environments.

WS-LIMIT-001 — Request Size Limits

What it checks: Sends a 15 MB POST request and checks for a 413 Request Entity Too Large response or connection reset.

Auto-fix applies:

client_max_body_size 10m;

WS-CONF-HSTS — nginx HSTS Config (Static)

What it checks: Parses nginx.conf directly to verify the add_header Strict-Transport-Security directive is present in server blocks handling HTTPS. Complements WS-HSTS-001 by inspecting the configuration source rather than the HTTP response.

WS-CONF-CSP — nginx CSP Config (Static)

What it checks: Parses nginx.conf to verify a Content-Security-Policy header directive is present. Distinguishes between headers correctly configured at the server level versus headers that may appear in HTTP responses due to intermediate infrastructure.