nginx custom command

gistfile1.txt

# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Block suspicious user agents (scanners/bots)
if ($http_user_agent ~* "(sqlmap|nikto|nmap|masscan|acunetix|netsparker|nessus|openvas|burpsuite|w3af|dirb|gobuster|wfuzz|ffuf)") {
    return 403;
}

# Block empty user agent
if ($http_user_agent = "") {
    return 403;
}

# Block suspicious paths
location ~ ^/(admin|wp-admin|wp-login|phpmyadmin|\.git|\.svn|\.env|config\.php|api/v1/login|api/login|login)$ {
    return 403;
}

# Block POST to suspicious endpoints
location ~ ^/(_next/formaction|api/formaction|formaction|actions|server-actions|apps)$ {
    if ($request_method = POST) {
        return 405;
    }
}

# Block suspicious query parameters (SQL injection, XSS)
if ($args ~* "(union|select|insert|delete|drop|exec|script|<script|javascript:|onerror=|onload=)") {
    return 403;
}

# Block suspicious file extensions
location ~ \.(env|git|svn|htaccess|htpasswd|ini|log|sh|sql|bak|backup|old|tmp|temp)$ {
    return 403;
}