Nginx Security And Performance Best Pratice

README.md

Reference used

https://www.acunetix.com/blog/web-security-zone/hardening-nginx/

Nginx Template

https://raw.githubusercontent.com/taufiqpsumarna/MERN-Docker-Production-Boilerplate/main/frontend/docker-setup/nginx/mern-template.conf

nginx.conf

server {
  server_name localhost; #change with your domain name
  client_max_body_size 10M;
  access_log            /var/log/nginx/access.log;
  error_log            /var/log/nginx/error.log;
  
  server_tokens off;
  
  gzip on;
  gzip_proxied any;
  gzip_comp_level 4;
  gzip_types text/css application/javascript image/svg+xml;
  
  # HSTS protection
  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
  
  # XSS protection in old browsers
  add_header X-XSS-Protection "1; mode=block";
  
  # Block leakage of information
  proxy_hide_header X-Powered-By;
  
  # Click-Jacking protection
  add_header X-Frame-Options "SAMEORIGIN";
  
  # Prevents unexpected cross-origin information leakage (Optional)
  add_header Referrer-Policy "strict-origin-when-cross-origin";
  
  # MIME-sniffing protection in old browsers
  add_header X-Content-Type-Options nosniff;
  
  #Use newer SSL Cipher (Disable This Option If You Use Certbot Cloudflare)
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;

  ...........
}