---
title: "Comment by Edge Ops on \"How to Audit HTTP Security Headers (CSP, HSTS & More)\" | Hashnode"
description: "For header audits I check HSTS only on HTTPS server blocks, keep CSP report-only first, and confirm nginx is not stripping headers set by the app via proxy_hide"
url: "https://hashnode.com/posts/how-to-audit-http-security-headers-csp-hsts-more/6addb85676ce72f6a3cf7b89/comment/6ae523083053abf345b04570"
---

[Discussion](https://hashnode.com/posts/how-to-audit-http-security-headers-csp-hsts-more/6addb85676ce72f6a3cf7b89)

Comment [How to Audit HTTP Security Headers (CSP, HSTS & More)](https://hashnode.com/posts/how-to-audit-http-security-headers-csp-hsts-more/6addb85676ce72f6a3cf7b89)

[Edge Ops](https://hashnode.com/@edgecacheops)

[Oct 30](https://hashnode.com/posts/how-to-audit-http-security-headers-csp-hsts-more/6addb85676ce72f6a3cf7b89/comment/6ae523083053abf345b04570)

For header audits I check HSTS only on HTTPS server blocks, keep CSP report-only first, and confirm nginx is not stripping headers set by the app via proxy\_hide\_header mistakes.

[Muhammad Ali Mughal](https://hashnode.com/@ali978123)

[Oct 31](https://hashnode.com/posts/how-to-audit-http-security-headers-csp-hsts-more/6addb85676ce72f6a3cf7b89/comment/6ae523083053abf345b04570#reply-6ae5304aac3dd9a37fc334c6)

Thanks, that's a solid checklist. One more nginx gotcha that bites a lot of header audits: add\_header directives are only inherited from the parent level if the current location block defines none of its own, so adding a single header inside a location can silently drop HSTS and CSP set at the server level. Adding the always flag also matters, otherwise the headers are skipped on 4xx and 5xx responses. Running curl -I against a few error pages as well as the homepage catches both.

[Edge Ops](https://hashnode.com/@edgecacheops)

[Oct 31](https://hashnode.com/posts/how-to-audit-http-security-headers-csp-hsts-more/6addb85676ce72f6a3cf7b89/comment/6ae523083053abf345b04570#reply-6ae532409e7c87c38ce40447)

Good catch on the inheritance trap — that one has bitten me more than once. I keep security headers in a single included snippet now so no location ever redefines `add_header`, and I always pair them with the `always` flag. One extra audit step that helps: after the homepage and error-page `curl -I` sweep, hit a 301/302 path too — some setups only attach headers on the final 200 and leave the redirect itself bare.