Securing NGINX on an Ubuntu VPS
A secure NGINX setup helps protect your websites, applications, and server resources. NGINX is strong by default, but a few practical changes can improve security for most hosting environments.
Step 1: Keep Ubuntu updated:
sudo apt update sudo apt upgrade
Step 2: Only open required firewall ports. For most websites, you need 80 and 443 publicly open. SSH should be restricted where possible.
sudo ufw allow ‘Nginx Full’ sudo ufw status
Step 3: Use SSL certificates for all public websites. Certbot is a common option:
sudo certbot —nginx
Step 4: Hide unnecessary information. You can disable server tokens in the NGINX configuration so version information is not displayed publicly.
Step 5: Protect sensitive files. Never allow public access to files such as .env, backups, database dumps, private keys, or application config files.
Step 6: Use rate limiting for login pages, API endpoints, or high-risk routes. Rate limiting can reduce brute-force attempts and abusive traffic.
Step 7: Review logs regularly:
sudo tail -f /var/log/nginx/access.log sudo tail -f /var/log/nginx/error.log
Step 8: Test configuration before reload:
sudo nginx -t sudo systemctl reload nginx
Good security is about layers. NGINX should work with a firewall, secure SSH, updated packages, strong application passwords, regular backups, and sensible file permissions.
If your server hosts multiple websites, keep each site in its own folder and server block. This makes it much easier to isolate issues, review permissions, and avoid one messy configuration affecting every hosted domain.