http-shield #
A small nginx dynamic module that blocks exploitation of web vulnerabilities that were patched years ago — SQL injection, ancient PHP/Java RCE chains, Log4Shell, Shellshock, path traversal, cloud-metadata SSRF, and more.
Source: our fork on GitHub
Directives
absolute_redirect #
syntax: absolute_redirect on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
accept_mutex #
syntax: accept_mutex on | off (on/off flag); · context: events
Boolean directive — set to "on" or "off".
accept_mutex_delay #
syntax: accept_mutex_delay 1 arg (duration in ms); · context: events
Duration in milliseconds; accepts ms / s / m suffixes.
acceptex_read #
syntax: acceptex_read on | off (on/off flag); · context: events
Boolean directive — set to "on" or "off".
access_log #
syntax: access_log 1+ args; · context: http, server, location, location-if, limit_except
acme #
syntax: acme 1 arg; · context: server
acme_client #
syntax: acme_client 2+ args; · context: http
acme_client_path #
syntax: acme_client_path 1 arg (string); · context: http
Stores a single string value.
acme_dns_port #
syntax: acme_dns_port 1 arg; · context: http
acme_hook #
syntax: acme_hook 1 arg; · context: location
acme_http_port #
syntax: acme_http_port 1 arg; · context: http
acme_max_response_size #
syntax: acme_max_response_size 1 arg (size (k/m/g)); · context: http
Size in bytes; accepts k / m / g suffixes.
add_after_body #
syntax: add_after_body 1 arg (string); · context: http, server, location
Stores a single string value.
add_before_body #
syntax: add_before_body 1 arg (string); · context: http, server, location
Stores a single string value.
add_header #
syntax: add_header 2 args; · context: http, server, location, location-if
add_trailer #
syntax: add_trailer 2 args; · context: http, server, location, location-if
addition_types #
syntax: addition_types 1+ args; · context: http, server, location
aio #
syntax: aio 1 arg; · context: http, server, location
aio_write #
syntax: aio_write on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
alias #
syntax: alias 1 arg; · context: location
allow #
syntax: allow 1 arg; · context: http, server, location, limit_except
ancient_browser #
syntax: ancient_browser 1+ args; · context: http, server, location
ancient_browser_value #
syntax: ancient_browser_value 1 arg; · context: http, server, location
api #
syntax: api 1 arg; · context: location
It tails the JSON log (surviving logrotate via an inode/offset state file), skips private/loopback/reserved IPs, de-duplicates each IP for 15 minutes (matching AbuseIPDB's own per-IP limit), enforces a daily cap (default 1000, the free tier), maps the shield category to AbuseIPDB IDs, and POSTs to /api/v2/report.
api_config_files #
syntax: api_config_files on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
auth_basic #
syntax: auth_basic 1 arg; · context: http, server, location, limit_except
auth_basic_user_file #
syntax: auth_basic_user_file 1 arg; · context: http, server, location, limit_except
auth_delay #
syntax: auth_delay 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
auth_http #
syntax: auth_http 1 arg; · context: mail, mail/server
auth_http_header #
syntax: auth_http_header 2 args; · context: mail, mail/server
auth_http_pass_client_cert #
syntax: auth_http_pass_client_cert on | off (on/off flag); · context: mail, mail/server
Boolean directive — set to "on" or "off".
auth_http_timeout #
syntax: auth_http_timeout 1 arg (duration in ms); · context: mail, mail/server
Duration in milliseconds; accepts ms / s / m suffixes.
auth_request #
syntax: auth_request 1 arg; · context: http, server, location
auth_request_set #
syntax: auth_request_set 2 args; · context: http, server, location
auto_redirect #
syntax: auto_redirect 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
autoindex #
syntax: autoindex on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
autoindex_exact_size #
syntax: autoindex_exact_size on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
autoindex_format #
syntax: autoindex_format 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
autoindex_localtime #
syntax: autoindex_localtime on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
break #
syntax: break no args; · context: server, location, server-if, location-if
req is the only attacker-controlled field: it is JSON-string-escaped (", \, and every byte below 0x20 become \uXXXX), so a hostile request line can neither inject a second record nor break the JSON.
charset #
syntax: charset 1 arg; · context: http, server, location, location-if
charset_map #
syntax: charset_map 2 args; · context: http
charset_types #
syntax: charset_types 1+ args; · context: http, server, location
chunked_transfer_encoding #
syntax: chunked_transfer_encoding on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
client #
syntax: client no args; · context: http
There is no rules language, no regex engine, no external ruleset to keep updated — just a fixed set of compiled-in signatures, each chosen so that no legitimate client ever sends it.
client_body_buffer_size #
syntax: client_body_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
client_body_in_file_only #
syntax: client_body_in_file_only 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
client_body_in_single_buffer #
syntax: client_body_in_single_buffer on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
client_body_temp_path #
syntax: client_body_temp_path 1 arg (filesystem path); · context: http, server, location
Filesystem path; may include cache parameters.
client_body_timeout #
syntax: client_body_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
client_header_buffer_size #
syntax: client_header_buffer_size 1 arg (size (k/m/g)); · context: http, server
Size in bytes; accepts k / m / g suffixes.
client_header_timeout #
syntax: client_header_timeout 1 arg (duration in ms); · context: http, server
Duration in milliseconds; accepts ms / s / m suffixes.
client_max_body_size #
syntax: client_max_body_size 1 arg (offset); · context: http, server, location
File offset; accepts size suffixes.
connection_pool_size #
syntax: connection_pool_size 1 arg (size (k/m/g)); · context: http, server
Size in bytes; accepts k / m / g suffixes.
create_full_put_path #
syntax: create_full_put_path on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
daemon #
syntax: daemon on | off (on/off flag); · context: main
Boolean directive — set to "on" or "off".
dav_access #
syntax: dav_access 1 arg (unix mode bits); · context: http, server, location
Unix permission bits (e.g. "user:rw group:r").
dav_methods #
syntax: dav_methods 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
debug_connection #
syntax: debug_connection 1 arg; · context: events
debug_points #
syntax: debug_points 1 arg (enum); · context: main
Pick one of an enumerated set of values.
default_type #
syntax: default_type 1 arg (string); · context: http, server, location
Stores a single string value.
degradation #
syntax: degradation 1 arg; · context: http
degrade #
syntax: degrade 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
deny #
syntax: deny 1 arg; · context: http, server, location, limit_except
directio #
syntax: directio 1 arg; · context: http, server, location
directio_alignment #
syntax: directio_alignment 1 arg (offset); · context: http, server, location
File offset; accepts size suffixes.
disable_symlinks #
syntax: disable_symlinks 1 arg; · context: http, server, location
docker_endpoint #
syntax: docker_endpoint 1 arg; · context: http
docker_max_object_size #
syntax: docker_max_object_size 1 arg (size (k/m/g)); · context: http
Size in bytes; accepts k / m / g suffixes.
doh_bind #
syntax: doh_bind 1 arg; · context: http, server, location
doh_buffer_size #
syntax: doh_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
doh_connect_timeout #
syntax: doh_connect_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
doh_max_size #
syntax: doh_max_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
doh_next_upstream #
syntax: doh_next_upstream 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
doh_next_upstream_timeout #
syntax: doh_next_upstream_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
doh_next_upstream_tries #
syntax: doh_next_upstream_tries 1 arg (integer); · context: http, server, location
Integer value.
doh_pass #
syntax: doh_pass 1 arg; · context: location, location-if
doh_read_timeout #
syntax: doh_read_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
doh_send_timeout #
syntax: doh_send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
doh_socket_keepalive #
syntax: doh_socket_keepalive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
doh_transport #
syntax: doh_transport 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
early_hints #
syntax: early_hints 1+ args; · context: http, server, location
empty_gif #
syntax: empty_gif no args; · context: location
env #
syntax: env 1 arg; · context: main
error_log #
syntax: error_log 1+ args; · context: http, server, location
error_log_user_tag #
syntax: error_log_user_tag 1 arg; · context: http, server, location, limit_except
error_page #
syntax: error_page 2+ args; · context: http, server, location, location-if
etag #
syntax: etag on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
events #
syntax: events no args; · context: main
expires #
syntax: expires 1 arg; · context: http, server, location, location-if
fastcgi_bind #
syntax: fastcgi_bind 1 arg; · context: http, server, location
fastcgi_buffer_size #
syntax: fastcgi_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
fastcgi_buffering #
syntax: fastcgi_buffering on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_buffers #
syntax: fastcgi_buffers 2 args (number and size of buffers); · context: http, server, location
Number and size of buffers, e.g. "32 4k".
fastcgi_busy_buffers_size #
syntax: fastcgi_busy_buffers_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
fastcgi_cache #
syntax: fastcgi_cache 1 arg; · context: http, server, location
fastcgi_cache_background_update #
syntax: fastcgi_cache_background_update on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_cache_bypass #
syntax: fastcgi_cache_bypass 1+ args; · context: http, server, location
fastcgi_cache_key #
syntax: fastcgi_cache_key 1 arg; · context: http, server, location
fastcgi_cache_lock #
syntax: fastcgi_cache_lock on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_cache_lock_age #
syntax: fastcgi_cache_lock_age 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
fastcgi_cache_lock_timeout #
syntax: fastcgi_cache_lock_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
fastcgi_cache_max_range_offset #
syntax: fastcgi_cache_max_range_offset 1 arg (offset); · context: http, server, location
File offset; accepts size suffixes.
fastcgi_cache_methods #
syntax: fastcgi_cache_methods 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
fastcgi_cache_min_uses #
syntax: fastcgi_cache_min_uses 1 arg (integer); · context: http, server, location
Integer value.
fastcgi_cache_path #
syntax: fastcgi_cache_path 2+ args; · context: http
fastcgi_cache_revalidate #
syntax: fastcgi_cache_revalidate on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_cache_use_stale #
syntax: fastcgi_cache_use_stale 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
fastcgi_cache_valid #
syntax: fastcgi_cache_valid 1+ args; · context: http, server, location
fastcgi_catch_stderr #
syntax: fastcgi_catch_stderr 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
fastcgi_connect_timeout #
syntax: fastcgi_connect_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
fastcgi_connection_drop #
syntax: fastcgi_connection_drop 1 arg; · context: http, server, location
fastcgi_force_ranges #
syntax: fastcgi_force_ranges on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_hide_header #
syntax: fastcgi_hide_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
fastcgi_ignore_client_abort #
syntax: fastcgi_ignore_client_abort on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_ignore_headers #
syntax: fastcgi_ignore_headers 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
fastcgi_index #
syntax: fastcgi_index 1 arg (string); · context: http, server, location
Stores a single string value.
fastcgi_intercept_errors #
syntax: fastcgi_intercept_errors on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_keep_conn #
syntax: fastcgi_keep_conn on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_limit_rate #
syntax: fastcgi_limit_rate 1 arg; · context: http, server, location
fastcgi_max_temp_file_size #
syntax: fastcgi_max_temp_file_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
fastcgi_next_upstream #
syntax: fastcgi_next_upstream 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
fastcgi_next_upstream_timeout #
syntax: fastcgi_next_upstream_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
fastcgi_next_upstream_tries #
syntax: fastcgi_next_upstream_tries 1 arg (integer); · context: http, server, location
Integer value.
fastcgi_no_cache #
syntax: fastcgi_no_cache 1+ args; · context: http, server, location
fastcgi_param #
syntax: fastcgi_param 2 args; · context: http, server, location
fastcgi_pass #
syntax: fastcgi_pass 1 arg; · context: location, location-if
fastcgi_pass_header #
syntax: fastcgi_pass_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
fastcgi_pass_request_body #
syntax: fastcgi_pass_request_body on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_pass_request_headers #
syntax: fastcgi_pass_request_headers on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_read_timeout #
syntax: fastcgi_read_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
fastcgi_request_buffering #
syntax: fastcgi_request_buffering on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_send_lowat #
syntax: fastcgi_send_lowat 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
fastcgi_send_timeout #
syntax: fastcgi_send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
fastcgi_socket_keepalive #
syntax: fastcgi_socket_keepalive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
fastcgi_split_path_info #
syntax: fastcgi_split_path_info 1 arg; · context: http, server, location
fastcgi_store #
syntax: fastcgi_store 1 arg; · context: http, server, location
fastcgi_store_access #
syntax: fastcgi_store_access 1 arg (unix mode bits); · context: http, server, location
Unix permission bits (e.g. "user:rw group:r").
fastcgi_temp_file_write_size #
syntax: fastcgi_temp_file_write_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
fastcgi_temp_path #
syntax: fastcgi_temp_path 1 arg (filesystem path); · context: http, server, location
Filesystem path; may include cache parameters.
flv #
syntax: flv no args; · context: location
geo #
syntax: geo 1 arg; · context: http
geoip_city #
syntax: geoip_city 1 arg; · context: http
geoip_country #
syntax: geoip_country 1 arg; · context: http
geoip_org #
syntax: geoip_org 1 arg; · context: http
geoip_proxy #
syntax: geoip_proxy 1 arg; · context: http
geoip_proxy_recursive #
syntax: geoip_proxy_recursive on | off (on/off flag); · context: http
Boolean directive — set to "on" or "off".
google_perftools_profiles #
syntax: google_perftools_profiles 1 arg (string); · context: main
Stores a single string value.
goto #
syntax: goto 1 arg; · context: server, location, server-if, location-if
grpc_bind #
syntax: grpc_bind 1 arg; · context: http, server, location
grpc_buffer_size #
syntax: grpc_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
grpc_connect_timeout #
syntax: grpc_connect_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
grpc_connection_drop #
syntax: grpc_connection_drop 1 arg; · context: http, server, location
grpc_hide_header #
syntax: grpc_hide_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
grpc_ignore_headers #
syntax: grpc_ignore_headers 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
grpc_intercept_errors #
syntax: grpc_intercept_errors on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
grpc_next_upstream #
syntax: grpc_next_upstream 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
grpc_next_upstream_timeout #
syntax: grpc_next_upstream_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
grpc_next_upstream_tries #
syntax: grpc_next_upstream_tries 1 arg (integer); · context: http, server, location
Integer value.
grpc_pass #
syntax: grpc_pass 1 arg; · context: location, location-if
grpc_pass_header #
syntax: grpc_pass_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
grpc_read_timeout #
syntax: grpc_read_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
grpc_send_timeout #
syntax: grpc_send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
grpc_set_header #
syntax: grpc_set_header 2 args (key value pair); · context: http, server, location
Stores a key/value pair.
grpc_socket_keepalive #
syntax: grpc_socket_keepalive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
grpc_ssl_certificate #
syntax: grpc_ssl_certificate 1 arg; · context: http, server, location
grpc_ssl_certificate_cache #
syntax: grpc_ssl_certificate_cache 1 arg; · context: http, server, location
grpc_ssl_certificate_key #
syntax: grpc_ssl_certificate_key 1 arg; · context: http, server, location
grpc_ssl_ciphers #
syntax: grpc_ssl_ciphers 1 arg (string); · context: http, server, location
Stores a single string value.
grpc_ssl_conf_command #
syntax: grpc_ssl_conf_command 2 args (key value pair); · context: http, server, location
Stores a key/value pair.
grpc_ssl_crl #
syntax: grpc_ssl_crl 1 arg (string); · context: http, server, location
Stores a single string value.
grpc_ssl_name #
syntax: grpc_ssl_name 1 arg; · context: http, server, location
grpc_ssl_password_file #
syntax: grpc_ssl_password_file 1 arg; · context: http, server, location
grpc_ssl_protocols #
syntax: grpc_ssl_protocols 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
grpc_ssl_server_name #
syntax: grpc_ssl_server_name on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
grpc_ssl_session_reuse #
syntax: grpc_ssl_session_reuse on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
grpc_ssl_trusted_certificate #
syntax: grpc_ssl_trusted_certificate 1 arg (string); · context: http, server, location
Stores a single string value.
grpc_ssl_verify #
syntax: grpc_ssl_verify on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
grpc_ssl_verify_depth #
syntax: grpc_ssl_verify_depth 1 arg (integer); · context: http, server, location
Integer value.
gunzip #
syntax: gunzip on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
gunzip_buffers #
syntax: gunzip_buffers 2 args (number and size of buffers); · context: http, server, location
Number and size of buffers, e.g. "32 4k".
gzip #
syntax: gzip on | off (on/off flag); · context: http, server, location, location-if
Boolean directive — set to "on" or "off".
gzip_buffers #
syntax: gzip_buffers 2 args (number and size of buffers); · context: http, server, location
Number and size of buffers, e.g. "32 4k".
gzip_comp_level #
syntax: gzip_comp_level 1 arg (integer); · context: http, server, location
Integer value.
gzip_disable #
syntax: gzip_disable 1+ args; · context: http, server, location
gzip_hash #
syntax: gzip_hash 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
gzip_http_version #
syntax: gzip_http_version 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
gzip_min_length #
syntax: gzip_min_length 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
gzip_no_buffer #
syntax: gzip_no_buffer on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
gzip_proxied #
syntax: gzip_proxied 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
gzip_static #
syntax: gzip_static 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
gzip_types #
syntax: gzip_types 1+ args; · context: http, server, location
gzip_vary #
syntax: gzip_vary on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
gzip_window #
syntax: gzip_window 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
hash #
syntax: hash 1 arg; · context: upstream
http #
syntax: http no args; · context: main
Larger bodies are passed through unscanned — uploads are never blocked for being big. Raise with care: scan cost is linear in this value and the body is attacker-controlled (see Cost). | | shield_status | http, server, location | 403 | Status returned in block mode.
http2 #
syntax: http2 on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
http2_body_preread_size #
syntax: http2_body_preread_size 1 arg (size (k/m/g)); · context: http, server
Size in bytes; accepts k / m / g suffixes.
http2_chunk_size #
syntax: http2_chunk_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
http2_idle_timeout #
syntax: http2_idle_timeout 1 arg; · context: http, server
http2_max_concurrent_pushes #
syntax: http2_max_concurrent_pushes 1 arg; · context: http, server
http2_max_concurrent_streams #
syntax: http2_max_concurrent_streams 1 arg (integer); · context: http, server
Integer value.
http2_max_field_size #
syntax: http2_max_field_size 1 arg; · context: http, server
http2_max_header_size #
syntax: http2_max_header_size 1 arg; · context: http, server
http2_max_requests #
syntax: http2_max_requests 1 arg; · context: http, server
http2_pool_size #
syntax: http2_pool_size 1 arg (size (k/m/g)); · context: http, server
Size in bytes; accepts k / m / g suffixes.
http2_push #
syntax: http2_push 1 arg; · context: http, server, location
http2_push_preload #
syntax: http2_push_preload on | off; · context: http, server, location
http2_recv_buffer_size #
syntax: http2_recv_buffer_size 1 arg (size (k/m/g)); · context: http
Size in bytes; accepts k / m / g suffixes.
http2_recv_timeout #
syntax: http2_recv_timeout 1 arg; · context: http, server
http2_streams_index_size #
syntax: http2_streams_index_size 1 arg (integer); · context: http, server
Integer value.
http3 #
syntax: http3 on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
http3_hq #
syntax: http3_hq on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
http3_max_concurrent_streams #
syntax: http3_max_concurrent_streams 1 arg (integer); · context: http, server
Integer value.
http3_max_table_capacity #
syntax: http3_max_table_capacity 1 arg (integer); · context: http, server
Integer value.
http3_stream_buffer_size #
syntax: http3_stream_buffer_size 1 arg (size (k/m/g)); · context: http, server
Size in bytes; accepts k / m / g suffixes.
if #
syntax: if 1+ args; · context: server, location
if_modified_since #
syntax: if_modified_since 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
ignore_invalid_headers #
syntax: ignore_invalid_headers on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
image_filter #
syntax: image_filter 1 arg; · context: location
image_filter_avif_quality #
syntax: image_filter_avif_quality 1 arg; · context: http, server, location
image_filter_buffer #
syntax: image_filter_buffer 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
image_filter_heic_quality #
syntax: image_filter_heic_quality 1 arg; · context: http, server, location
image_filter_interlace #
syntax: image_filter_interlace on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
image_filter_jpeg_quality #
syntax: image_filter_jpeg_quality 1 arg; · context: http, server, location
image_filter_sharpen #
syntax: image_filter_sharpen 1 arg; · context: http, server, location
image_filter_transparency #
syntax: image_filter_transparency on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
image_filter_webp_quality #
syntax: image_filter_webp_quality 1 arg; · context: http, server, location
imap_auth #
syntax: imap_auth 1+ args (bitmask); · context: mail, mail/server
Bitmask — combine several keywords.
imap_capabilities #
syntax: imap_capabilities 1+ args; · context: mail, mail/server
imap_client_buffer #
syntax: imap_client_buffer 1 arg (size (k/m/g)); · context: mail, mail/server
Size in bytes; accepts k / m / g suffixes.
include #
syntax: include 1 arg;
Scannable media types include form and multipart data, text/, JSON and XML, structured application/+json / application/*+xml types, GraphQL, NDJSON, JSON text sequences, and YAML.
index #
syntax: index 1+ args; · context: http, server, location
internal #
syntax: internal no args; · context: location
ip_hash #
syntax: ip_hash no args; · context: upstream
keepalive #
syntax: keepalive 1 arg; · context: upstream
keepalive_disable #
syntax: keepalive_disable 1 arg (bitmask); · context: http, server, location
Bitmask — combine several keywords.
keepalive_requests #
syntax: keepalive_requests 1 arg (integer); · context: http, server, location
Integer value.
keepalive_time #
syntax: keepalive_time 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
keepalive_timeout #
syntax: keepalive_timeout 1 arg; · context: http, server, location
large_client_header_buffers #
syntax: large_client_header_buffers 2 args (number and size of buffers); · context: http, server
Number and size of buffers, e.g. "32 4k".
least_conn #
syntax: least_conn no args; · context: upstream
least_time #
syntax: least_time 1+ args; · context: upstream
limit_conn #
syntax: limit_conn 2 args; · context: http, server, location
limit_conn_dry_run #
syntax: limit_conn_dry_run on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
limit_conn_log_level #
syntax: limit_conn_log_level 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
limit_conn_status #
syntax: limit_conn_status 1 arg (integer); · context: http, server, location
Integer value.
limit_conn_zone #
syntax: limit_conn_zone 2 args; · context: http
limit_except #
syntax: limit_except 1+ args; · context: location
limit_rate #
syntax: limit_rate 1 arg; · context: http, server, location, location-if
limit_rate_after #
syntax: limit_rate_after 1 arg; · context: http, server, location, location-if
limit_req #
syntax: limit_req 1 arg; · context: http, server, location
limit_req_dry_run #
syntax: limit_req_dry_run on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
limit_req_log_level #
syntax: limit_req_log_level 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
limit_req_status #
syntax: limit_req_status 1 arg (integer); · context: http, server, location
Integer value.
limit_req_zone #
syntax: limit_req_zone 3 args; · context: http
lingering_close #
syntax: lingering_close 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
lingering_time #
syntax: lingering_time 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
lingering_timeout #
syntax: lingering_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
listen #
syntax: listen 1+ args; · context: server
load_module #
syntax: load_module 1 arg; · context: main
location #
syntax: location 1+ args; · context: server, location
Larger bodies are passed through unscanned — uploads are never blocked for being big. Raise with care: scan cost is linear in this value and the body is attacker-controlled (see Cost). | | shield_status | http, server, location | 403 | Status returned in block mode.
log_format #
syntax: log_format 2+ args; · context: http
log_not_found #
syntax: log_not_found on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
log_subrequest #
syntax: log_subrequest on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
mail #
syntax: mail no args; · context: main
map #
syntax: map 2 args; · context: http
For AbuseIPDB, map each cat to a category ID (most → 21 Web App Attack; sqli also → 16 SQL Injection). #### Syslog transport Instead of a file, ship the same JSON records to a syslog server: The syslog: options are nginx's standard ngx_syslog set (server=, facility=, tag=, severity=, nohostname).
master_process #
syntax: master_process on | off (on/off flag); · context: main
Boolean directive — set to "on" or "off".
memcached_bind #
syntax: memcached_bind 1 arg; · context: http, server, location
memcached_buffer_size #
syntax: memcached_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
memcached_connect_timeout #
syntax: memcached_connect_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
memcached_gzip_flag #
syntax: memcached_gzip_flag 1 arg (integer); · context: http, server, location
Integer value.
memcached_next_upstream #
syntax: memcached_next_upstream 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
memcached_next_upstream_timeout #
syntax: memcached_next_upstream_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
memcached_next_upstream_tries #
syntax: memcached_next_upstream_tries 1 arg (integer); · context: http, server, location
Integer value.
memcached_pass #
syntax: memcached_pass 1 arg; · context: location, location-if
memcached_read_timeout #
syntax: memcached_read_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
memcached_send_timeout #
syntax: memcached_send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
memcached_socket_keepalive #
syntax: memcached_socket_keepalive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
merge_slashes #
syntax: merge_slashes on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
metric #
syntax: metric 2 args; · context: http, server, location
metric_complex_zone #
syntax: metric_complex_zone 1 arg; · context: http
metric_zone #
syntax: metric_zone 2+ args; · context: http
min_delete_depth #
syntax: min_delete_depth 1 arg (integer); · context: http, server, location
Integer value.
mirror #
syntax: mirror 1 arg; · context: http, server, location
mirror_request_body #
syntax: mirror_request_body on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
modern_browser #
syntax: modern_browser 1 arg; · context: http, server, location
modern_browser_value #
syntax: modern_browser_value 1 arg; · context: http, server, location
mp4 #
syntax: mp4 no args; · context: location
mp4_buffer_size #
syntax: mp4_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
mp4_limit_rate #
syntax: mp4_limit_rate 1 arg; · context: http, server, location
mp4_limit_rate_after #
syntax: mp4_limit_rate_after 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
mp4_max_buffer_size #
syntax: mp4_max_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
mp4_start_key_frame #
syntax: mp4_start_key_frame on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
mqtt_preread #
syntax: mqtt_preread on | off (on/off flag); · context: stream, stream/server
Boolean directive — set to "on" or "off".
msie_padding #
syntax: msie_padding on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
msie_refresh #
syntax: msie_refresh on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
multi_accept #
syntax: multi_accept on | off (on/off flag); · context: events
Boolean directive — set to "on" or "off".
open_file_cache #
syntax: open_file_cache 1 arg; · context: http, server, location
open_file_cache_errors #
syntax: open_file_cache_errors on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
open_file_cache_events #
syntax: open_file_cache_events on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
open_file_cache_min_uses #
syntax: open_file_cache_min_uses 1 arg (integer); · context: http, server, location
Integer value.
open_file_cache_valid #
syntax: open_file_cache_valid 1 arg (duration in seconds); · context: http, server, location
Duration in seconds; accepts s / m / h / d suffixes.
open_log_file_cache #
syntax: open_log_file_cache 1 arg; · context: http, server, location
output_buffers #
syntax: output_buffers 2 args (number and size of buffers); · context: http, server, location
Number and size of buffers, e.g. "32 4k".
override_charset #
syntax: override_charset on | off (on/off flag); · context: http, server, location, location-if
Boolean directive — set to "on" or "off".
pass #
syntax: pass 1 arg; · context: stream/server
For each request it builds two normalized copies of every inspected input — a lowercased raw copy and a percent-decoded (once), +→space, lowercased copy — and runs every enabled category's patterns over them in a single Aho-Corasick pass per buffer.
pcre_jit #
syntax: pcre_jit on | off (on/off flag); · context: main
Boolean directive — set to "on" or "off".
perl #
syntax: perl 1 arg; · context: location, limit_except
perl_modules #
syntax: perl_modules 1 arg (list of strings); · context: http
Appends a string to a list; may be specified multiple times.
perl_require #
syntax: perl_require 1 arg (list of strings); · context: http
Appends a string to a list; may be specified multiple times.
perl_set #
syntax: perl_set 2 args; · context: http
pop3_auth #
syntax: pop3_auth 1+ args (bitmask); · context: mail, mail/server
Bitmask — combine several keywords.
pop3_capabilities #
syntax: pop3_capabilities 1+ args; · context: mail, mail/server
port_in_redirect #
syntax: port_in_redirect on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
post_action #
syntax: post_action 1 arg (string); · context: http, server, location, location-if
Stores a single string value.
postpone_gzipping #
syntax: postpone_gzipping 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
postpone_output #
syntax: postpone_output 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
preread_buffer_size #
syntax: preread_buffer_size 1 arg (size (k/m/g)); · context: stream, stream/server
Size in bytes; accepts k / m / g suffixes.
preread_timeout #
syntax: preread_timeout 1 arg (duration in ms); · context: stream, stream/server
Duration in milliseconds; accepts ms / s / m suffixes.
prometheus #
syntax: prometheus 1 arg; · context: location
prometheus_template #
syntax: prometheus_template 1 arg; · context: http
protocol #
syntax: protocol 1 arg; · context: mail/server
proxy #
syntax: proxy on | off (on/off flag); · context: mail, mail/server
Boolean directive — set to "on" or "off".
proxy_bind #
syntax: proxy_bind 1 arg; · context: http, server, location
proxy_buffer #
syntax: proxy_buffer 1 arg (size (k/m/g)); · context: mail, mail/server
Size in bytes; accepts k / m / g suffixes.
proxy_buffer_size #
syntax: proxy_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
proxy_buffering #
syntax: proxy_buffering on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_buffers #
syntax: proxy_buffers 2 args (number and size of buffers); · context: http, server, location
Number and size of buffers, e.g. "32 4k".
proxy_busy_buffers_size #
syntax: proxy_busy_buffers_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
proxy_cache #
syntax: proxy_cache 1 arg; · context: http, server, location
proxy_cache_background_update #
syntax: proxy_cache_background_update on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_cache_bypass #
syntax: proxy_cache_bypass 1+ args; · context: http, server, location
proxy_cache_convert_head #
syntax: proxy_cache_convert_head on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_cache_key #
syntax: proxy_cache_key 1 arg; · context: http, server, location
proxy_cache_lock #
syntax: proxy_cache_lock on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_cache_lock_age #
syntax: proxy_cache_lock_age 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
proxy_cache_lock_timeout #
syntax: proxy_cache_lock_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
proxy_cache_max_range_offset #
syntax: proxy_cache_max_range_offset 1 arg (offset); · context: http, server, location
File offset; accepts size suffixes.
proxy_cache_methods #
syntax: proxy_cache_methods 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
proxy_cache_min_uses #
syntax: proxy_cache_min_uses 1 arg (integer); · context: http, server, location
Integer value.
proxy_cache_path #
syntax: proxy_cache_path 2+ args; · context: http
proxy_cache_revalidate #
syntax: proxy_cache_revalidate on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_cache_use_stale #
syntax: proxy_cache_use_stale 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
proxy_cache_valid #
syntax: proxy_cache_valid 1+ args; · context: http, server, location
proxy_connect_timeout #
syntax: proxy_connect_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
proxy_connection_drop #
syntax: proxy_connection_drop 1 arg; · context: http, server, location
proxy_download_rate #
syntax: proxy_download_rate 1 arg; · context: stream, stream/server
proxy_downstream_buffer #
syntax: proxy_downstream_buffer 1 arg (size (k/m/g)); · context: stream, stream/server
Size in bytes; accepts k / m / g suffixes.
proxy_force_ranges #
syntax: proxy_force_ranges on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_half_close #
syntax: proxy_half_close on | off (on/off flag); · context: stream, stream/server
Boolean directive — set to "on" or "off".
proxy_headers_hash_bucket_size #
syntax: proxy_headers_hash_bucket_size 1 arg (integer); · context: http, server, location
Integer value.
proxy_headers_hash_max_size #
syntax: proxy_headers_hash_max_size 1 arg (integer); · context: http, server, location
Integer value.
proxy_hide_header #
syntax: proxy_hide_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
proxy_http3_hq #
syntax: proxy_http3_hq on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_http3_max_concurrent_streams #
syntax: proxy_http3_max_concurrent_streams 1 arg (integer); · context: http, server, location
Integer value.
proxy_http3_max_table_capacity #
syntax: proxy_http3_max_table_capacity 1 arg (integer); · context: http, server, location
Integer value.
proxy_http3_stream_buffer_size #
syntax: proxy_http3_stream_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
proxy_http_version #
syntax: proxy_http_version 1 arg (enum); · context: http, server, location, location-if, limit_except
also allowed in all places where "proxy_pass" can happen
proxy_ignore_client_abort #
syntax: proxy_ignore_client_abort on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_ignore_headers #
syntax: proxy_ignore_headers 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
proxy_intercept_errors #
syntax: proxy_intercept_errors on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_limit_rate #
syntax: proxy_limit_rate 1 arg; · context: http, server, location
proxy_max_temp_file_size #
syntax: proxy_max_temp_file_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
proxy_method #
syntax: proxy_method 1 arg; · context: http, server, location
proxy_next_upstream #
syntax: proxy_next_upstream 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
proxy_next_upstream_timeout #
syntax: proxy_next_upstream_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
proxy_next_upstream_tries #
syntax: proxy_next_upstream_tries 1 arg (integer); · context: http, server, location
Integer value.
proxy_no_cache #
syntax: proxy_no_cache 1+ args; · context: http, server, location
proxy_pass #
syntax: proxy_pass 1 arg; · context: location, location-if, limit_except
proxy_pass_error_message #
syntax: proxy_pass_error_message on | off (on/off flag); · context: mail, mail/server
Boolean directive — set to "on" or "off".
proxy_pass_header #
syntax: proxy_pass_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
proxy_pass_request_body #
syntax: proxy_pass_request_body on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_pass_request_headers #
syntax: proxy_pass_request_headers on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_pass_trailers #
syntax: proxy_pass_trailers on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_protocol #
syntax: proxy_protocol on | off (on/off flag); · context: mail, mail/server
Boolean directive — set to "on" or "off".
proxy_protocol_timeout #
syntax: proxy_protocol_timeout 1 arg (duration in ms); · context: stream, stream/server
Duration in milliseconds; accepts ms / s / m suffixes.
proxy_protocol_tlv #
syntax: proxy_protocol_tlv 2 args; · context: stream, stream/server
proxy_protocol_version #
syntax: proxy_protocol_version 1 arg (enum); · context: stream, stream/server
Pick one of an enumerated set of values.
proxy_quic_active_connection_id_limit #
syntax: proxy_quic_active_connection_id_limit 1 arg (integer); · context: http, server, location
Integer value.
proxy_quic_gso #
syntax: proxy_quic_gso on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_quic_host_key #
syntax: proxy_quic_host_key 1 arg; · context: http, server, location
proxy_read_timeout #
syntax: proxy_read_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
proxy_redirect #
syntax: proxy_redirect 1 arg; · context: http, server, location
proxy_request_buffering #
syntax: proxy_request_buffering on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_requests #
syntax: proxy_requests 1 arg (integer); · context: stream, stream/server
Integer value.
proxy_responses #
syntax: proxy_responses 1 arg (integer); · context: stream, stream/server
Integer value.
proxy_send_lowat #
syntax: proxy_send_lowat 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
proxy_send_timeout #
syntax: proxy_send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
proxy_set_body #
syntax: proxy_set_body 1 arg (string); · context: http, server, location
Stores a single string value.
proxy_set_header #
syntax: proxy_set_header 2 args (key value pair); · context: http, server, location
Stores a key/value pair.
proxy_smtp_auth #
syntax: proxy_smtp_auth on | off (on/off flag); · context: mail, mail/server
Boolean directive — set to "on" or "off".
proxy_socket_keepalive #
syntax: proxy_socket_keepalive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_ssl #
syntax: proxy_ssl on | off (on/off flag); · context: stream, stream/server
Boolean directive — set to "on" or "off".
proxy_ssl_alpn #
syntax: proxy_ssl_alpn 1+ args; · context: stream, stream/server
proxy_ssl_certificate #
syntax: proxy_ssl_certificate 1 arg; · context: http, server, location
proxy_ssl_certificate_cache #
syntax: proxy_ssl_certificate_cache 1 arg; · context: http, server, location
proxy_ssl_certificate_key #
syntax: proxy_ssl_certificate_key 1 arg; · context: http, server, location
proxy_ssl_ciphers #
syntax: proxy_ssl_ciphers 1 arg (string); · context: http, server, location
Stores a single string value.
proxy_ssl_conf_command #
syntax: proxy_ssl_conf_command 2 args (key value pair); · context: http, server, location
Stores a key/value pair.
proxy_ssl_crl #
syntax: proxy_ssl_crl 1 arg (string); · context: http, server, location
Stores a single string value.
proxy_ssl_keylog_file #
syntax: proxy_ssl_keylog_file 1 arg; · context: http, server, location
proxy_ssl_name #
syntax: proxy_ssl_name 1 arg; · context: http, server, location
proxy_ssl_ntls #
syntax: proxy_ssl_ntls on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_ssl_password_file #
syntax: proxy_ssl_password_file 1 arg; · context: http, server, location
proxy_ssl_protocols #
syntax: proxy_ssl_protocols 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
proxy_ssl_server_name #
syntax: proxy_ssl_server_name on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_ssl_session_reuse #
syntax: proxy_ssl_session_reuse on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_ssl_trusted_certificate #
syntax: proxy_ssl_trusted_certificate 1 arg (string); · context: http, server, location
Stores a single string value.
proxy_ssl_verify #
syntax: proxy_ssl_verify on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
proxy_ssl_verify_depth #
syntax: proxy_ssl_verify_depth 1 arg (integer); · context: http, server, location
Integer value.
proxy_store #
syntax: proxy_store 1 arg; · context: http, server, location
proxy_store_access #
syntax: proxy_store_access 1 arg (unix mode bits); · context: http, server, location
Unix permission bits (e.g. "user:rw group:r").
proxy_temp_file_write_size #
syntax: proxy_temp_file_write_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
proxy_temp_path #
syntax: proxy_temp_path 1 arg (filesystem path); · context: http, server, location
Filesystem path; may include cache parameters.
proxy_timeout #
syntax: proxy_timeout 1 arg (duration in ms); · context: mail, mail/server
Duration in milliseconds; accepts ms / s / m suffixes.
proxy_upload_rate #
syntax: proxy_upload_rate 1 arg; · context: stream, stream/server
proxy_upstream_buffer #
syntax: proxy_upstream_buffer 1 arg (size (k/m/g)); · context: stream, stream/server
Size in bytes; accepts k / m / g suffixes.
quic_active_connection_id_limit #
syntax: quic_active_connection_id_limit 1 arg (integer); · context: http, server
Integer value.
quic_bpf #
syntax: quic_bpf on | off (on/off flag); · context: main
Boolean directive — set to "on" or "off".
quic_gso #
syntax: quic_gso on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
quic_host_key #
syntax: quic_host_key 1 arg; · context: http, server
quic_retry #
syntax: quic_retry on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
random #
syntax: random no args; · context: upstream
Opaque header values deliberately do not run short gadget/webshell tokens that would eventually collide with random credentials or multipart boundary entropy.
random_index #
syntax: random_index on | off (on/off flag); · context: location
Boolean directive — set to "on" or "off".
rdp_preread #
syntax: rdp_preread on | off (on/off flag); · context: stream, stream/server
Boolean directive — set to "on" or "off".
read_ahead #
syntax: read_ahead 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
real_ip_header #
syntax: real_ip_header 1 arg; · context: http, server, location
real_ip_recursive #
syntax: real_ip_recursive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
recursive_error_pages #
syntax: recursive_error_pages on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
referer_hash_bucket_size #
syntax: referer_hash_bucket_size 1 arg (integer); · context: server, location
Integer value.
referer_hash_max_size #
syntax: referer_hash_max_size 1 arg (integer); · context: server, location
Integer value.
request_pool_size #
syntax: request_pool_size 1 arg (size (k/m/g)); · context: http, server
Size in bytes; accepts k / m / g suffixes.
reset_timedout_connection #
syntax: reset_timedout_connection on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
resolver #
syntax: resolver 1+ args; · context: upstream
resolver_timeout #
syntax: resolver_timeout 1 arg (duration in ms); · context: upstream
Duration in milliseconds; accepts ms / s / m suffixes.
response_time_factor #
syntax: response_time_factor 1 arg (integer); · context: upstream
Integer value.
return #
syntax: return 1 arg; · context: server, location, server-if, location-if
rewrite #
syntax: rewrite 2 args; · context: server, location, server-if, location-if
rewrite_log #
syntax: rewrite_log on | off (on/off flag); · context: http, server, location, server-if, location-if
Boolean directive — set to "on" or "off".
root #
syntax: root 1 arg; · context: http, server, location, location-if
The file is reopened on SIGUSR1 (logrotate-safe). No | command form. shield runs in PRECONTENT on every request inside root-started workers; piping attacker-influenced bytes into a forked shell would reintroduce exactly the command-injection and fork-storm/DoS class this module exists to block — so shield_log "| ..." is rejected at config load.
satisfy #
syntax: satisfy 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
scgi_bind #
syntax: scgi_bind 1 arg; · context: http, server, location
scgi_buffer_size #
syntax: scgi_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
scgi_buffering #
syntax: scgi_buffering on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_buffers #
syntax: scgi_buffers 2 args (number and size of buffers); · context: http, server, location
Number and size of buffers, e.g. "32 4k".
scgi_busy_buffers_size #
syntax: scgi_busy_buffers_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
scgi_cache #
syntax: scgi_cache 1 arg; · context: http, server, location
scgi_cache_background_update #
syntax: scgi_cache_background_update on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_cache_bypass #
syntax: scgi_cache_bypass 1+ args; · context: http, server, location
scgi_cache_key #
syntax: scgi_cache_key 1 arg; · context: http, server, location
scgi_cache_lock #
syntax: scgi_cache_lock on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_cache_lock_age #
syntax: scgi_cache_lock_age 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
scgi_cache_lock_timeout #
syntax: scgi_cache_lock_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
scgi_cache_max_range_offset #
syntax: scgi_cache_max_range_offset 1 arg (offset); · context: http, server, location
File offset; accepts size suffixes.
scgi_cache_methods #
syntax: scgi_cache_methods 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
scgi_cache_min_uses #
syntax: scgi_cache_min_uses 1 arg (integer); · context: http, server, location
Integer value.
scgi_cache_path #
syntax: scgi_cache_path 2+ args; · context: http
scgi_cache_revalidate #
syntax: scgi_cache_revalidate on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_cache_use_stale #
syntax: scgi_cache_use_stale 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
scgi_cache_valid #
syntax: scgi_cache_valid 1+ args; · context: http, server, location
scgi_connect_timeout #
syntax: scgi_connect_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
scgi_connection_drop #
syntax: scgi_connection_drop 1 arg; · context: http, server, location
scgi_force_ranges #
syntax: scgi_force_ranges on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_hide_header #
syntax: scgi_hide_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
scgi_ignore_client_abort #
syntax: scgi_ignore_client_abort on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_ignore_headers #
syntax: scgi_ignore_headers 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
scgi_intercept_errors #
syntax: scgi_intercept_errors on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_limit_rate #
syntax: scgi_limit_rate 1 arg; · context: http, server, location
scgi_max_temp_file_size #
syntax: scgi_max_temp_file_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
scgi_next_upstream #
syntax: scgi_next_upstream 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
scgi_next_upstream_timeout #
syntax: scgi_next_upstream_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
scgi_next_upstream_tries #
syntax: scgi_next_upstream_tries 1 arg (integer); · context: http, server, location
Integer value.
scgi_no_cache #
syntax: scgi_no_cache 1+ args; · context: http, server, location
scgi_param #
syntax: scgi_param 2 args; · context: http, server, location
scgi_pass #
syntax: scgi_pass 1 arg; · context: location, location-if
scgi_pass_header #
syntax: scgi_pass_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
scgi_pass_request_body #
syntax: scgi_pass_request_body on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_pass_request_headers #
syntax: scgi_pass_request_headers on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_read_timeout #
syntax: scgi_read_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
scgi_request_buffering #
syntax: scgi_request_buffering on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_send_timeout #
syntax: scgi_send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
scgi_socket_keepalive #
syntax: scgi_socket_keepalive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
scgi_store #
syntax: scgi_store 1 arg; · context: http, server, location
scgi_store_access #
syntax: scgi_store_access 1 arg (unix mode bits); · context: http, server, location
Unix permission bits (e.g. "user:rw group:r").
scgi_temp_file_write_size #
syntax: scgi_temp_file_write_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
scgi_temp_path #
syntax: scgi_temp_path 1 arg (filesystem path); · context: http, server, location
Filesystem path; may include cache parameters.
secure_link #
syntax: secure_link 1 arg; · context: http, server, location
secure_link_md5 #
syntax: secure_link_md5 1 arg; · context: http, server, location
secure_link_secret #
syntax: secure_link_secret 1 arg (string); · context: http, server, location
Stores a single string value.
send_lowat #
syntax: send_lowat 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
send_timeout #
syntax: send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
sendfile #
syntax: sendfile on | off (on/off flag); · context: http, server, location, location-if
Boolean directive — set to "on" or "off".
sendfile_max_chunk #
syntax: sendfile_max_chunk 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
server #
syntax: server 1+ args; · context: upstream
Larger bodies are passed through unscanned — uploads are never blocked for being big. Raise with care: scan cost is linear in this value and the body is attacker-controlled (see Cost). | | shield_status | http, server, location | 403 | Status returned in block mode.
server_name #
syntax: server_name 1+ args; · context: server
server_name_in_redirect #
syntax: server_name_in_redirect on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
server_names_hash_bucket_size #
syntax: server_names_hash_bucket_size 1 arg (integer); · context: http
Integer value.
server_names_hash_max_size #
syntax: server_names_hash_max_size 1 arg (integer); · context: http
Integer value.
server_tokens #
syntax: server_tokens 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
set #
syntax: set 2 args; · context: server, location, server-if, location-if
There is no rules language, no regex engine, no external ruleset to keep updated — just a fixed set of compiled-in signatures, each chosen so that no legitimate client ever sends it.
set_real_ip_from #
syntax: set_real_ip_from 1 arg; · context: http, server, location
shield_ban_zone #
syntax: shield_ban_zone 1 arg; · context: http
See Hit log. | | shield_ban_zone | http | — | Define a shared-memory zone name:size (e.g.
shield_body #
syntax: shield_body on | off (on/off flag); · context: http, server, location
http, server, location
shield_max_body #
syntax: shield_max_body 1 arg (size (k/m/g)); · context: http, server, location
http, server, location
shield_probe #
syntax: shield_probe 1 arg; · context: location
CI-only introspection endpoint; absent from any build that does not define NGX_TEST_HARNESS, so a config using it fails to load there rather than silently exposing zone internals.
shield_status #
syntax: shield_status 1 arg; · context: http, server, location
http, server, location
slice #
syntax: slice 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
smtp_auth #
syntax: smtp_auth 1+ args (bitmask); · context: mail, mail/server
Bitmask — combine several keywords.
smtp_capabilities #
syntax: smtp_capabilities 1+ args; · context: mail, mail/server
smtp_client_buffer #
syntax: smtp_client_buffer 1 arg (size (k/m/g)); · context: mail, mail/server
Size in bytes; accepts k / m / g suffixes.
smtp_greeting_delay #
syntax: smtp_greeting_delay 1 arg (duration in ms); · context: mail, mail/server
Duration in milliseconds; accepts ms / s / m suffixes.
source_charset #
syntax: source_charset 1 arg; · context: http, server, location, location-if
split_clients #
syntax: split_clients 2 args; · context: http
ssi #
syntax: ssi on | off (on/off flag); · context: http, server, location, location-if
<!--#exec, <!--#include virtual
ssi_ignore_recycled_buffers #
syntax: ssi_ignore_recycled_buffers on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
ssi_last_modified #
syntax: ssi_last_modified on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
ssi_min_file_chunk #
syntax: ssi_min_file_chunk 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
ssi_silent_errors #
syntax: ssi_silent_errors on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
ssi_types #
syntax: ssi_types 1+ args; · context: http, server, location
ssi_value_length #
syntax: ssi_value_length 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
ssl_alpn #
syntax: ssl_alpn 1+ args; · context: stream, stream/server
ssl_buffer_size #
syntax: ssl_buffer_size 1 arg (size (k/m/g)); · context: http, server
Size in bytes; accepts k / m / g suffixes.
ssl_certificate #
syntax: ssl_certificate 1 arg; · context: http, server
ssl_certificate_cache #
syntax: ssl_certificate_cache 1 arg; · context: http, server
ssl_certificate_compression #
syntax: ssl_certificate_compression on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
ssl_certificate_key #
syntax: ssl_certificate_key 1 arg; · context: http, server
ssl_ciphers #
syntax: ssl_ciphers 1 arg (string); · context: http, server
Stores a single string value.
ssl_client_certificate #
syntax: ssl_client_certificate 1 arg (string); · context: http, server
Stores a single string value.
ssl_conf_command #
syntax: ssl_conf_command 2 args (key value pair); · context: http, server
Stores a key/value pair.
ssl_dhparam #
syntax: ssl_dhparam 1 arg (string); · context: http, server
Stores a single string value.
ssl_early_data #
syntax: ssl_early_data on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
ssl_ecdh_curve #
syntax: ssl_ecdh_curve 1 arg (string); · context: http, server
Stores a single string value.
ssl_encrypted_hello_key #
syntax: ssl_encrypted_hello_key 1 arg (list of strings); · context: http, server
Appends a string to a list; may be specified multiple times.
ssl_engine #
syntax: ssl_engine 1 arg; · context: main
ssl_handshake_timeout #
syntax: ssl_handshake_timeout 1 arg (duration in ms); · context: stream, stream/server
Duration in milliseconds; accepts ms / s / m suffixes.
ssl_keylog_file #
syntax: ssl_keylog_file 1 arg; · context: http, server
ssl_ntls #
syntax: ssl_ntls on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
ssl_object_cache_inheritable #
syntax: ssl_object_cache_inheritable on | off (on/off flag); · context: main
Boolean directive — set to "on" or "off".
ssl_ocsp #
syntax: ssl_ocsp 1 arg (enum); · context: http, server
Pick one of an enumerated set of values.
ssl_ocsp_cache #
syntax: ssl_ocsp_cache 1 arg; · context: http, server
ssl_ocsp_responder #
syntax: ssl_ocsp_responder 1 arg (string); · context: http, server
Stores a single string value.
ssl_password_file #
syntax: ssl_password_file 1 arg; · context: http, server
ssl_prefer_server_ciphers #
syntax: ssl_prefer_server_ciphers on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
ssl_preread #
syntax: ssl_preread on | off (on/off flag); · context: stream, stream/server
Boolean directive — set to "on" or "off".
ssl_protocols #
syntax: ssl_protocols 1+ args (bitmask); · context: http, server
Bitmask — combine several keywords.
ssl_reject_handshake #
syntax: ssl_reject_handshake on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
ssl_session_cache #
syntax: ssl_session_cache 1 arg; · context: http, server
ssl_session_ticket_key #
syntax: ssl_session_ticket_key 1 arg (list of strings); · context: http, server
Appends a string to a list; may be specified multiple times.
ssl_session_tickets #
syntax: ssl_session_tickets on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
ssl_session_timeout #
syntax: ssl_session_timeout 1 arg (duration in seconds); · context: http, server
Duration in seconds; accepts s / m / h / d suffixes.
ssl_stapling #
syntax: ssl_stapling on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
ssl_stapling_file #
syntax: ssl_stapling_file 1 arg (string); · context: http, server
Stores a single string value.
ssl_stapling_responder #
syntax: ssl_stapling_responder 1 arg (string); · context: http, server
Stores a single string value.
ssl_stapling_verify #
syntax: ssl_stapling_verify on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
ssl_trusted_certificate #
syntax: ssl_trusted_certificate 1 arg (string); · context: http, server
Stores a single string value.
ssl_verify_client #
syntax: ssl_verify_client 1 arg (enum); · context: http, server
Pick one of an enumerated set of values.
starttls #
syntax: starttls 1 arg; · context: mail, mail/server
status_zone #
syntax: status_zone 1 arg; · context: server
sticky #
syntax: sticky 2+ args; · context: upstream
sticky_secret #
syntax: sticky_secret 1 arg; · context: upstream
sticky_strict #
syntax: sticky_strict on | off (on/off flag); · context: upstream
Boolean directive — set to "on" or "off".
stream #
syntax: stream no args; · context: main
stub_status #
syntax: stub_status no args; · context: server, location
sub_filter #
syntax: sub_filter 2 args; · context: http, server, location
sub_filter_last_modified #
syntax: sub_filter_last_modified on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
sub_filter_once #
syntax: sub_filter_once on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
sub_filter_types #
syntax: sub_filter_types 1+ args; · context: http, server, location
subrequest_output_buffer_size #
syntax: subrequest_output_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
tcp_nodelay #
syntax: tcp_nodelay on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
tcp_nopush #
syntax: tcp_nopush on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
thread_pool #
syntax: thread_pool 2 args; · context: main
time_format #
syntax: time_format 2 args; · context: http
timeout #
syntax: timeout 1 arg (duration in ms); · context: mail, mail/server
Duration in milliseconds; accepts ms / s / m suffixes.
timer_resolution #
syntax: timer_resolution 1 arg (duration in ms); · context: main
Duration in milliseconds; accepts ms / s / m suffixes.
try_files #
syntax: try_files 2+ args; · context: server, location
tunnel_bind #
syntax: tunnel_bind 1 arg; · context: http, server, location
tunnel_buffer_size #
syntax: tunnel_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
tunnel_connect_timeout #
syntax: tunnel_connect_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
tunnel_next_upstream #
syntax: tunnel_next_upstream 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
tunnel_next_upstream_timeout #
syntax: tunnel_next_upstream_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
tunnel_next_upstream_tries #
syntax: tunnel_next_upstream_tries 1 arg (integer); · context: http, server, location
Integer value.
tunnel_pass #
syntax: tunnel_pass no args; · context: server, location, location-if
tunnel_read_timeout #
syntax: tunnel_read_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
tunnel_send_lowat #
syntax: tunnel_send_lowat 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
tunnel_send_timeout #
syntax: tunnel_send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
tunnel_socket_keepalive #
syntax: tunnel_socket_keepalive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
types #
syntax: types no args; · context: http, server, location
Scannable media types include form and multipart data, text/, JSON and XML, structured application/+json / application/*+xml types, GraphQL, NDJSON, JSON text sequences, and YAML.
types_hash_bucket_size #
syntax: types_hash_bucket_size 1 arg (integer); · context: http, server, location
Integer value.
types_hash_max_size #
syntax: types_hash_max_size 1 arg (integer); · context: http, server, location
Integer value.
underscores_in_headers #
syntax: underscores_in_headers on | off (on/off flag); · context: http, server
Boolean directive — set to "on" or "off".
uninitialized_variable_warn #
syntax: uninitialized_variable_warn on | off (on/off flag); · context: http, server, location, server-if, location-if
Boolean directive — set to "on" or "off".
upstream #
syntax: upstream 1 arg; · context: http
use #
syntax: use 1 arg; · context: events
File and syslog are mutually exclusive per directive; use off to disable, and a child off overrides an inherited parent. #### Reporting to AbuseIPDB reporter/abuseipdb-reporter.py is a ready-to-run reporter for the file sink.
user #
syntax: user 1 arg; · context: main
Measured over the scan core: | buffer | bytes | µs/scan | |---|---|---| | typical URI + user-agent | 358 | 1.0 | | 8 KB body (default cap) | 8 192 | 23 | | hostile all-/ buffer | 512 | 1.4 | A worker is single-threaded, so scan time is blocking — whatever it costs, that worker serves nobody else.
userid #
syntax: userid 1 arg (enum); · context: http, server, location
Pick one of an enumerated set of values.
userid_domain #
syntax: userid_domain 1 arg (string); · context: http, server, location
Stores a single string value.
userid_expires #
syntax: userid_expires 1 arg; · context: http, server, location
userid_flags #
syntax: userid_flags 1 arg (bitmask); · context: http, server, location
Bitmask — combine several keywords.
userid_mark #
syntax: userid_mark 1 arg; · context: http, server, location
userid_name #
syntax: userid_name 1 arg (string); · context: http, server, location
Stores a single string value.
userid_p3p #
syntax: userid_p3p 1 arg (string); · context: http, server, location
Stores a single string value.
userid_path #
syntax: userid_path 1 arg (string); · context: http, server, location
Stores a single string value.
userid_service #
syntax: userid_service 1 arg (integer); · context: http, server, location
Integer value.
uwsgi_bind #
syntax: uwsgi_bind 1 arg; · context: http, server, location
uwsgi_buffer_size #
syntax: uwsgi_buffer_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
uwsgi_buffering #
syntax: uwsgi_buffering on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_buffers #
syntax: uwsgi_buffers 2 args (number and size of buffers); · context: http, server, location
Number and size of buffers, e.g. "32 4k".
uwsgi_busy_buffers_size #
syntax: uwsgi_busy_buffers_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
uwsgi_cache #
syntax: uwsgi_cache 1 arg; · context: http, server, location
uwsgi_cache_background_update #
syntax: uwsgi_cache_background_update 1 arg (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_cache_bypass #
syntax: uwsgi_cache_bypass 1+ args; · context: http, server, location
uwsgi_cache_key #
syntax: uwsgi_cache_key 1 arg; · context: http, server, location
uwsgi_cache_lock #
syntax: uwsgi_cache_lock on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_cache_lock_age #
syntax: uwsgi_cache_lock_age 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
uwsgi_cache_lock_timeout #
syntax: uwsgi_cache_lock_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
uwsgi_cache_max_range_offset #
syntax: uwsgi_cache_max_range_offset 1 arg (offset); · context: http, server, location
File offset; accepts size suffixes.
uwsgi_cache_methods #
syntax: uwsgi_cache_methods 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
uwsgi_cache_min_uses #
syntax: uwsgi_cache_min_uses 1 arg (integer); · context: http, server, location
Integer value.
uwsgi_cache_path #
syntax: uwsgi_cache_path 2+ args; · context: http
uwsgi_cache_revalidate #
syntax: uwsgi_cache_revalidate on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_cache_use_stale #
syntax: uwsgi_cache_use_stale 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
uwsgi_cache_valid #
syntax: uwsgi_cache_valid 1+ args; · context: http, server, location
uwsgi_connect_timeout #
syntax: uwsgi_connect_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
uwsgi_connection_drop #
syntax: uwsgi_connection_drop 1 arg; · context: http, server, location
uwsgi_force_ranges #
syntax: uwsgi_force_ranges on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_hide_header #
syntax: uwsgi_hide_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
uwsgi_ignore_client_abort #
syntax: uwsgi_ignore_client_abort on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_ignore_headers #
syntax: uwsgi_ignore_headers 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
uwsgi_intercept_errors #
syntax: uwsgi_intercept_errors on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_limit_rate #
syntax: uwsgi_limit_rate 1 arg; · context: http, server, location
uwsgi_max_temp_file_size #
syntax: uwsgi_max_temp_file_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
uwsgi_modifier1 #
syntax: uwsgi_modifier1 1 arg (integer); · context: http, server, location
Integer value.
uwsgi_modifier2 #
syntax: uwsgi_modifier2 1 arg (integer); · context: http, server, location
Integer value.
uwsgi_next_upstream #
syntax: uwsgi_next_upstream 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
uwsgi_next_upstream_timeout #
syntax: uwsgi_next_upstream_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
uwsgi_next_upstream_tries #
syntax: uwsgi_next_upstream_tries 1 arg (integer); · context: http, server, location
Integer value.
uwsgi_no_cache #
syntax: uwsgi_no_cache 1+ args; · context: http, server, location
uwsgi_param #
syntax: uwsgi_param 2 args; · context: http, server, location
uwsgi_pass #
syntax: uwsgi_pass 1 arg; · context: location, location-if
uwsgi_pass_header #
syntax: uwsgi_pass_header 1 arg (list of strings); · context: http, server, location
Appends a string to a list; may be specified multiple times.
uwsgi_pass_request_body #
syntax: uwsgi_pass_request_body on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_pass_request_headers #
syntax: uwsgi_pass_request_headers on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_read_timeout #
syntax: uwsgi_read_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
uwsgi_request_buffering #
syntax: uwsgi_request_buffering on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_send_timeout #
syntax: uwsgi_send_timeout 1 arg (duration in ms); · context: http, server, location
Duration in milliseconds; accepts ms / s / m suffixes.
uwsgi_socket_keepalive #
syntax: uwsgi_socket_keepalive on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_ssl_certificate #
syntax: uwsgi_ssl_certificate 1 arg; · context: http, server, location
uwsgi_ssl_certificate_cache #
syntax: uwsgi_ssl_certificate_cache 1 arg; · context: http, server, location
uwsgi_ssl_certificate_key #
syntax: uwsgi_ssl_certificate_key 1 arg; · context: http, server, location
uwsgi_ssl_ciphers #
syntax: uwsgi_ssl_ciphers 1 arg (string); · context: http, server, location
Stores a single string value.
uwsgi_ssl_conf_command #
syntax: uwsgi_ssl_conf_command 2 args (key value pair); · context: http, server, location
Stores a key/value pair.
uwsgi_ssl_crl #
syntax: uwsgi_ssl_crl 1 arg (string); · context: http, server, location
Stores a single string value.
uwsgi_ssl_name #
syntax: uwsgi_ssl_name 1 arg; · context: http, server, location
uwsgi_ssl_password_file #
syntax: uwsgi_ssl_password_file 1 arg; · context: http, server, location
uwsgi_ssl_protocols #
syntax: uwsgi_ssl_protocols 1+ args (bitmask); · context: http, server, location
Bitmask — combine several keywords.
uwsgi_ssl_server_name #
syntax: uwsgi_ssl_server_name on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_ssl_session_reuse #
syntax: uwsgi_ssl_session_reuse on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_ssl_trusted_certificate #
syntax: uwsgi_ssl_trusted_certificate 1 arg (string); · context: http, server, location
Stores a single string value.
uwsgi_ssl_verify #
syntax: uwsgi_ssl_verify on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
uwsgi_ssl_verify_depth #
syntax: uwsgi_ssl_verify_depth 1 arg (integer); · context: http, server, location
Integer value.
uwsgi_store #
syntax: uwsgi_store 1 arg; · context: http, server, location
uwsgi_store_access #
syntax: uwsgi_store_access 1 arg (unix mode bits); · context: http, server, location
Unix permission bits (e.g. "user:rw group:r").
uwsgi_string #
syntax: uwsgi_string 1 arg (string); · context: http, server, location
Stores a single string value.
uwsgi_temp_file_write_size #
syntax: uwsgi_temp_file_write_size 1 arg (size (k/m/g)); · context: http, server, location
Size in bytes; accepts k / m / g suffixes.
uwsgi_temp_path #
syntax: uwsgi_temp_path 1 arg (filesystem path); · context: http, server, location
Filesystem path; may include cache parameters.
valid_referers #
syntax: valid_referers 1+ args; · context: server, location
variables_hash_bucket_size #
syntax: variables_hash_bucket_size 1 arg (integer); · context: http
Integer value.
variables_hash_max_size #
syntax: variables_hash_max_size 1 arg (integer); · context: http
Integer value.
worker_connections #
syntax: worker_connections 1 arg; · context: events
worker_cpu_affinity #
syntax: worker_cpu_affinity 1+ args; · context: main
worker_priority #
syntax: worker_priority 1 arg; · context: main
worker_processes #
syntax: worker_processes 1 arg; · context: main
worker_rlimit_core #
syntax: worker_rlimit_core 1 arg (offset); · context: main
File offset; accepts size suffixes.
worker_shutdown_timeout #
syntax: worker_shutdown_timeout 1 arg (duration in ms); · context: main
Duration in milliseconds; accepts ms / s / m suffixes.
working_directory #
syntax: working_directory 1 arg (string); · context: main
Stores a single string value.
xclient #
syntax: xclient on | off (on/off flag); · context: mail, mail/server
Boolean directive — set to "on" or "off".
xml_entities #
syntax: xml_entities 1 arg; · context: http, server, location
xslt_last_modified #
syntax: xslt_last_modified on | off (on/off flag); · context: http, server, location
Boolean directive — set to "on" or "off".
xslt_param #
syntax: xslt_param 2 args; · context: http, server, location
xslt_string_param #
syntax: xslt_string_param 2 args; · context: http, server, location
xslt_stylesheet #
syntax: xslt_stylesheet 1+ args; · context: location
xslt_types #
syntax: xslt_types 1+ args; · context: http, server, location
zone #
syntax: zone 1 arg; · context: upstream
See Hit log. | | shield_ban_zone | http | — | Define a shared-memory zone name:size (e.g.
Example
http {
# Turn on globally in detect mode first, watch the logs, then switch to block.
shield detect;
# Optional: a shared-memory zone for the repeat-offender ban list.
shield_ban_zone shield:10m;
server {
location / {
shield block; # off | detect | block
shield_body on; # inspect request body (default on)
shield_max_body 8k; # bytes of body scanned (default 8k)
shield_status 403; # 403 | 404 | 419 | 429 | 444 (default 403)
shield_log /var/log/nginx/shield.json; # JSON hit log (off by default)
# Ban an IP for 1h once it trips 5 signatures within 1 minute.
shield_ban zone=shield count=5 window=1m bantime=1h;
}
location /legacy-app/ {
shield block;
shield_skip sqli xss; # disable specific categories here
}
}
}