Applies HTTP response security headers to every hosted site and reloads the web server. On nginx the headers go into a server-level include (/etc/nginx/vinza-headers/security-headers.conf) that every site vhost loads, plus helper maps under conf.d; on Apache they go into conf-enabled. All file writes, the nginx -t check and the reload run through the root agent, so the panel process itself never needs privilege — and on nginx a failed config test aborts the apply rather than reloading a broken server.

Two presets are built in. Moderate sets X-Frame-Options SAMEORIGIN, X-Content-Type-Options, X-XSS-Protection, a Referrer-Policy, a small Permissions-Policy and a one-year HSTS. Strict tightens those to DENY, strict-origin-when-cross-origin, a two-year HSTS (preload is a separate opt-in), and adds a restrictive default Content-Security-Policy. You can also submit an arbitrary header set, which is filtered against an allowlist of ten headers (the ones above plus the three Cross-Origin-* policies) — anything outside that list is silently dropped. A preset of none, or the remove action, deletes the snippet and reloads.

Currently active headers are read back by parsing the deployed snippet, so the UI reflects what is actually on disk rather than a stored copy. Note that despite the name, this is a global setting: the snippet applies to every site the web server hosts, there is no per-domain configuration, and the page is admin-gated for that reason.

OpenLiteSpeed is not supported for global headers — it has no equivalent http-level snippet. The plugin installs fine there but refuses the apply and points you at per-site .htaccess Header directives via each website's Web Rules, instead of writing to a nonexistent nginx path and failing the reload. Setting a strict CSP can break sites that rely on inline or third-party scripts, so it is worth testing before applying it across every hosted domain.

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Free — no key needed

Permissions

websites.manage

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.1.2: Per-site policies: a CSP builder (directives and sources, Report-Only mode) with a report collector in the panel that site owners can read; COOP/COEP/CORP and CORS (allowed origins, methods, headers, credentials, preflight) per site, rendered for nginx and Apache and shown as .htaccess lines on OpenLiteSpeed; a live scan of the site that compares the headers it really sends with the configured ones. "Remove all" keeps per-site policies. 1.1.1: "Regenerate their vhosts" works on release builds: the check for the vhost include read the panel's compiled vhost template as text and always reported it missing. 1.1.0: Headers now reach every hosted site: nginx sends them from a server-level include that each site vhost loads (include /etc/nginx/vinza-headers/*.conf), because a vhost with its own add_header never inherited the old http-level snippet. Strict preset no longer sets HSTS preload (opt-in, with preload-list checks). CSP, X-Frame-Options and COEP are not sent on webmail/phpMyAdmin paths unless chosen. Header values are validated, a failed nginx test rolls the files back, and the page shows how many sites load the include. 1.0.0: Initial release. Nginx/Apache support, preset profiles, per-domain config.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/security-headers/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "security-headers",
  "version": "1.1.2",
  "download_url": "..."
}