Security Hardening

Hide What You Are Running

server_tokens off;              # hide version in error pages
# optional header removal in nginx.conf

Security Headers

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
# add HSTS only after HTTPS is verified working

Rate Limiting

limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

location /login {
    limit_req zone=login burst=10 nodelay;
    proxy_pass http://127.0.0.1:8080;
}

Basic brute-force protection for login routes; raise or lower the rate to fit your users.

Block Dangerous Requests

# deny access to hidden files (dotfiles)
location ~ /\. { deny all; }

# block common scanner paths
location ~* \.(php|asp|aspx|jsp)$ { deny all; }   # only if you serve no PHP

Bad Bots and Large Uploads

location / { if ($http_user_agent ~* (ahrefs|semrush|curl) ) { return 403; } }

client_max_body_size 10m;   # cap uploads (matches your app limit)

Key Points

• Headers + rate limits + hidden versions cover the common attacks.
• Deny scan/script paths proactively; cap upload sizes.
• Keep Nginx patched - subscribe to the security mailing list.