NGINX security analyzer - detect SSRF, injection, SSL/TLS issues & auto-fix them
10K+
Prevent security misconfigurations before they become vulnerabilities.
Gixy is a powerful static analysis tool that detects security issues in your NGINX configuration files. Originally developed by Yandex and now actively maintained by GetPageSpeed.
🌐 Homepage: gixy.org
| Category | Security Checks |
|---|---|
| 🔓 Injection & Forgery | SSRF · HTTP Splitting · Host Spoofing · Origin Bypass |
| 🔐 TLS & Encryption | Weak SSL/TLS · HTTP/2 Misdirected Request · Version Disclosure |
| 📂 Path Traversal | Alias Traversal · Proxy Pass Issues |
| 📋 Header Security | HSTS · Header Redefinition · Content-Type Hijacking |
| 🚦 Access Control | ACL Bypasses · Referer Validation Issues |
| ⚙️ Config & Performance | ReDoS · Invalid Regex · Dangerous if Statements |
# Analyze your NGINX config
docker run --rm -v /etc/nginx:/etc/nginx:ro getpagespeed/gixy /etc/nginx/nginx.conf
# Analyze a local file
docker run --rm -v $(pwd)/nginx.conf:/nginx.conf:ro getpagespeed/gixy /nginx.conf
# Auto-fix mode (preview)
docker run --rm -v /etc/nginx:/etc/nginx getpagespeed/gixy --fix-dry-run /etc/nginx/nginx.conf
Gixy can automatically fix many issues it detects:
# Preview fixes (dry run)
docker run --rm -v /etc/nginx:/etc/nginx getpagespeed/gixy --fix-dry-run /etc/nginx/nginx.conf
# Apply fixes (creates .bak backups)
docker run --rm -v /etc/nginx:/etc/nginx getpagespeed/gixy --fix /etc/nginx/nginx.conf
Analyze NGINX Ingress Controller configs:
kubectl exec -it <nginx-ingress-pod> -- cat /etc/nginx/nginx.conf | docker run -i getpagespeed/gixy -
Content type
Image
Digest
sha256:f6eeb6f9e…
Size
22.1 MB
Last updated
3 days ago
docker pull getpagespeed/gixy