SEAES Infrastructure Security Report

Add HTTP → HTTPS redirect.
In Cloudflare: Page Rules → Always Use HTTPS.
Or on origin nginx: return 301 https://$host$request_uri;

Add Strict-Transport-Security header.
In Cloudflare → SSL/TLS → Edge Certificates → Enable HSTS.
Or nginx: add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains' always;

Add missing security headers: X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy, Permissions-Policy.
Add these headers in nginx server block or via Cloudflare Transform Rules.

Fix HTTP redirect to include https:// scheme.
The current redirect points to /login without the scheme, causing a protocol downgrade.

Set cookie security flags on csrftoken.
Configure: csrftoken=value; Secure; HttpOnly; SameSite=Lax

Hide nginx version in Server header.
Add server_tokens off; to nginx.conf to stop leaking nginx/1.20.1.

Add X-XSS-Protection header.
Add add_header X-XSS-Protection "1; mode=block" always; in nginx or Cloudflare Transform Rules.