Check your nginx config.
nginx will serve happily with old TLS, no security headers, and its version on display. Paste your config and get a security review — weak TLS, missing headers, version disclosure, no rate limiting, directory listing — each with the fix.
Serving fine, quietly insecure
An nginx config is one of those things you set up once and never look at again — which is exactly why the weak defaults persist. Old TLS that a scanner flags, a missing HSTS header, the version banner advertising what to attack, an unbounded request body that lets one upload chew through resources. None of it stops the site working; all of it shows up in a security review or, worse, in an incident. A two-minute read now is cheaper than either.
Getting the config right once is the easy part. Ongoing drift detection requires explicit coverage, reporting, and alert configuration for each relevant managed host and route; a control plane does not make the result universal.
Right once, and kept that way.
For configured managed origin routes, Infraveil can report selected policy and drift evidence. It does not manage every edge, guarantee that TLS, headers, or limits remain set, or prove configuration state. Generate a starting config with our proxy and headers tools, then verify it independently.
See how it works