Nginx Configuration Pro

Nginx Configuration Pro is an IDE-native nginx security analyzer and config linter. It audits your nginx.conf against a Gixy-parity check set, warns about CVEs affecting your installed nginx version, and flags ReDoS-prone regex patterns — while you type, with one-click fixes, and without leaving the IDE.

Built-in Nginx Security Analyzer

• Gixy-parity security audit — full parity with Gixy-Next 0.3.4: all 38 upstream checks implemented plus regex_redos as a separate heuristic inspection. Covers alias_traversal, host_spoofing, http_splitting (across add_header, proxy_set_header, rewrite, return, proxy_pass), if_is_evil, origins/CORS validators (wildcard + credentials, $http_referrer typo, missing regex anchors, unescaped hostname dots), hsts_header (weak max-age, missing includeSubDomains, http-level inheritance), ssrf, ssl_stapling_without_resolver, weak_ssl_tls, version_disclosure, add_header_redefinition, proxy_pass_normalized, quic_bpf_reuseport, http2_misdirected_request, stale_dns_cache, unanchored_regex, invalid_regex, and more.
• CVE advisor inspection — set your installed nginx version in the inspection settings and the plugin reports CVEs affecting it, with config-trigger pattern matching where relevant: CVE-2026-9256, CVE-2026-42945 (NGINX Rift, rewrite-rift trigger), CVE-2026-42946 (scgi/uwsgi), CVE-2026-40460 (HTTP/3), CVE-2021-23017 (resolver), CVE-2019-9511, CVE-2024-7347 (mp4), CVE-2022-41741 (mp4), CVE-2017-7529.
• ReDoS detection — a dedicated heuristic analyzer parses regex patterns from location ~/~*, if regex conditions, map source values with ~/~*, and the rewrite pattern, and flags nested unbounded quantifiers (exponential (a+)+), overlapping alternatives inside a quantified group (polynomial (a|ab)+), and adjacent broad greedy quantifiers (polynomial .*.*end).
• Extra checks beyond Gixy — CVE matching, SSL certificate path existence, autoindex on exposure, CORS wildcard combined with credentials, HTTPS→HTTP downgrade, open-proxy patterns, and generic security-header checks.

Catch Errors Before They Reach Production

• 28 inspections, most with quick fixes — wrong contexts, invalid parameters, missing semicolons, undefined upstreams and variables, SSL best practices, deprecated listen parameters, performance checks, and the security analyzer above. Validates 1090+ directives from the built-in catalog.
• Run nginx -t from the IDE — the Nginx Operations tool window validates every nginx root config in your project against a local nginx binary or any running Docker container, shows results in a per-root tree with clickable error hyperlinks, and switches environments from a single selector.
• Context-aware autocomplete — suggests only directives valid in the current block. Completes upstream names in proxy_pass, paths in include, and variable names.
• Quick documentation — hover over any directive or variable to see its description, allowed contexts, and a link to official nginx docs.

Navigate and Refactor with Confidence

• Go to Definition — Ctrl+Click on include paths, upstream names, variables, and named locations. Supports glob patterns in includes.
• Find Usages — see where any upstream, variable, or named location is referenced across your project.
• Rename — rename upstreams, variables, and named locations with automatic reference updates across all config files.
• Safe Delete — checks usages before removing upstreams or files.
• Breadcrumbs — always see where you are: http > server > location /api.

Write Configs Faster

• 30+ live templates — type proxy + Tab for a reverse proxy block, ssl + Tab for SSL config. Covers WebSocket, PHP-FPM, static files, CORS, rate limiting, caching, and more.
• Intentions — extract blocks to include files, inline includes, convert listen to IPv6, add SSL redirects — all via Alt+Enter.
• Code formatting — reformat entire configs with column alignment in map, geo, and types blocks.

Beyond Standard Nginx

• Custom directives — define your own directives with allowed contexts and parameter descriptions. Share definitions with your team via Settings > Tools > Nginx Custom Directives.
• Docker support — recognizes *.conf.template files with ${VARNAME} envsubst placeholders.
• Third-party modules — OpenResty (Lua, Echo, Headers More), Brotli, MaxMind GeoIP2.
• Lua blocks — syntax highlighting inside content_by_lua_block and similar directives (requires a Lua plugin).

Getting Started

1. Install the plugin and open any .conf or nginx.conf file — inspections and autocomplete work immediately
2. Open the Nginx Operations tool window and click Validate to run nginx -t on every root config — pick a local binary or a running Docker container in the environment selector
3. Try Ctrl+Click on an include path or upstream name to navigate
4. Type proxy + Tab inside a location block to insert a reverse proxy template

Links

• Documentation
• Report an issue
• Other plugins by meanmail