How do you harden an Nginx deployment?

Hardening is layered. Nginx can enforce transport, header and request-shape controls, but it cannot fix application authorization bugs. The goal is to reduce attack surface and make abuse expensive without blocking legitimate traffic.

server_tokens off;
client_max_body_size 2m;
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/nginx/tls/example.com.crt;
    ssl_certificate_key /etc/nginx/tls/example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'self'" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location ~ /\.(?!well-known) {
        deny all;
    }

    location = /login {
        limit_req zone=login burst=5 nodelay;
        proxy_pass http://auth;
    }
}

Controls worth having

• Run workers as an unprivileged user and keep secrets out of the config repository
• Patch Nginx and modules promptly and remove unused modules
• Disable autoindex, hide version tokens and restrict status endpoints to localhost
• Set body size limits and timeouts to curb resource exhaustion
• Rate limit authentication and expensive endpoints more strictly than general traffic
• Validate and normalize forwarded headers, and reject ambiguous request framing at the edge
• Add a WAF or upstream filtering only with tuning, because a default ruleset can cause false positives