Security & setup warnings - Nextcloud on nginx shared hosting

🚧 Installation
1

Hello

I’ve been using ownCloud with no problems, but have just switched to Nextcloud. The installation seems to be working without problem, but I’m getting the same ‘Security & setup warnings’ that others have reported here, that is:

    Some files have not passed the integrity check. Further information on how to resolve this issue can be found in our documentation. (List of invalid files… / Rescan…)

    The "X-XSS-Protection" HTTP header is not configured to equal to "1; mode=block". This is a potential security or privacy risk and we recommend adjusting this setting.
    The "X-Content-Type-Options" HTTP header is not configured to equal to "nosniff". This is a potential security or privacy risk and we recommend adjusting this setting.
    The "X-Frame-Options" HTTP header is not configured to equal to "SAMEORIGIN". This is a potential security or privacy risk and we recommend adjusting this setting.
    The "Strict-Transport-Security" HTTP header is not configured to at least "15552000" seconds. For enhanced security we recommend enabling HSTS as described in our security tips.

    No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our documentation.
    The PHP OPcache is not properly configured. For better performance we recommend to use following settings in the php.ini:

    opcache.enable=1
    opcache.enable_cli=1
    opcache.interned_strings_buffer=8
    opcache.max_accelerated_files=10000
    opcache.memory_consumption=128
    opcache.save_comments=1
    opcache.revalidate_freq=1

From reading the threads here, I gather that there is a special installation method for installing on servers running nginx. However I’m on nginx shared hosting, so can’t follow such advice.

I guess that there is therefore no way for me to correct these issues, but that security and performance is no worse than if I were to return to ownCloud?

2

Yes normally you let nginx add such headers via the webserver’s configuration file. ownCloud and Nextcloud are very similar, I’m not sure how this part developed, perhaps NC only added more sophisticated warnings, so you just don’t see the warnings in owncloud (you could install owncloud and use curl to check for such headers manually).

It should be possible to let php add these headers manually, @LukasReschke is there a suitable place to do that? Or would it even be possible to make a security-header app that adds such headers for hosted environments?