Free tools Windows power users keep installed
One-click scans. No signup required.
The safest Nginx deployment is patched, HTTPS-only, minimally exposed, authenticated at sensitive paths, rate-limited where abuse is likely, and verified after every change. Start by mapping your installed package and modules, compare its branch with the current Nginx security advisories, and upgrade to a fixed build. At the time of writing (September 15, 2026), the Nginx download page lists 1.30.5 as stable and 1.31.6 as mainline; those labels and fixed-version ranges can change when new CVEs are published.
The configuration examples below are deliberately conservative starting points. Values such as a 1 request/second login limit or a 10 MB shared-memory zone are examples from Nginx documentation, not universal capacity recommendations. Load-test them with your application, proxy topology, and legitimate traffic patterns.
1. Inventory Nginx before changing it
Record the package version, enabled modules, listening addresses and ports, upstreams, administrative URLs, authentication boundaries, and any trusted reverse proxies. This inventory tells you what is actually reachable and prevents a hardening change from protecting the wrong server block.
- Check the installed version and build options with
nginx -Vand your operating system’s package manager. - List every
listendirective, including IPv4 and IPv6, and confirm which ports the host firewall exposes. - Identify admin, login, API, health, upload, and internal paths separately; they need different controls.
- Document which upstream addresses are trusted to supply client-IP headers. Never trust an arbitrary Internet client to set its own source address.
2. Patch first and track CVEs
Before tuning headers or limits, compare your installed branch with the Nginx security-advisory page. Map each CVE to its fixed version, upgrade to a package that contains the fix, and retain signed-package verification where your distribution provides it. The September 15, 2026 release information lists 1.30.5 stable and 1.31.6 mainline and includes a fix for CVE-2026-90439. The advisory also lists fixed ranges for CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, and other issues; check the advisory again whenever you publish or schedule an upgrade.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
Stable or mainline?
Use the branch your operating system or Nginx support policy requires, but do not leave an installed branch unpatched merely because it is labelled stable. Mainline and stable labels are release-channel descriptions; the security advisory is the authority for whether a specific version contains a fix.
A safe upgrade sequence
- Back up the active configuration, certificates, private keys, and package metadata.
- Verify the repository signature or package signature supplied by your platform.
- Install the fixed package, run
nginx -t, and inspect the error log for module or directive incompatibilities. - Reload only after syntax validation, then test externally over HTTP and HTTPS.
- Record the version, advisory references, test results, and rollback package so the next review is repeatable.
3. Redirect HTTP and configure modern TLS
Serve application traffic on HTTPS and make the port-80 server a redirect unless you have a deliberate reason to serve cleartext. Nginx’s HTTPS example enables TLS 1.2 and TLS 1.3; older protocol versions should not be enabled simply for compatibility without a documented exception.
server {
listen 80;
listen [::]:80;
server_name app.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name app.example.com;
ssl_certificate /etc/nginx/tls/site-chain.pem;
ssl_certificate_key /etc/nginx/tls/site.key;
ssl_protocols TLSv1.2 TLSv1.3;
location / {
proxy_pass http://app_backend;
}
}The private key is a security-sensitive file. It must be readable by the Nginx master process but not by ordinary users or unrelated services. Set ownership and permissions according to your distribution’s Nginx account, for example with a mode such as 600, and verify that a configuration test can still read it. Keep the certificate chain separate from the private key and renew certificates before expiry.
Test the externally observed result
- Request the HTTP URL and confirm a single redirect to the intended HTTPS host.
- Use an external TLS client to confirm that only TLS 1.2 and 1.3 are negotiated.
- Check that the certificate name, chain, and expiry are correct from outside the host.
- Test an application URL that needs authentication; a successful handshake must not imply authorization.
4. Reduce the attack surface
Bind only required addresses and ports
Remove unused listen directives, close unused ports at the host firewall, and bind services to private interfaces when they do not need public exposure. Review IPv6 separately; an IPv4-only firewall rule does not protect an accidentally exposed IPv6 listener.
Deny sensitive files and methods
Do not let a web root expose Nginx configuration, version-control metadata, backups, environment files, private keys, or secret-bearing archives. A narrowly scoped deny rule is safer than trying to enumerate every possible filename:
location ~* /(?:.git|.svn|.hg|.env|backup|backups|config|secrets)(?:/|$) {
deny all;
return 404;
}
location ~* .(?:key|pem|p12|sql|bak|old|swp)$ {
deny all;
return 404;
}
if ($request_method !~ ^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$) {
return 405;
}Prefer placing application files outside the public document root and granting Nginx read access only to directories it must serve. Test that legitimate API methods still work after restricting methods.
5. Authenticate administrative and internal paths
Choose the control that matches your trust model rather than applying one mechanism everywhere. Open-source Nginx supports Basic Authentication, subrequest authentication, and IP restrictions. Nginx Plus adds documented JWT and OpenID Connect controls, dynamic denylisting, and broader traffic-management features.
Basic authentication for a small admin surface
location /admin/ {
auth_basic "Restricted area";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_pass http://app_backend;
}Use Basic Auth only over HTTPS and protect the password file like any other secret. For an organization-wide identity boundary, put authentication in a dedicated identity service or use the Nginx Plus JWT/OIDC capabilities when those are part of your support and licensing decision.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIP restrictions and subrequest authorization
IP allowlists are useful for a private operations network, but they are brittle for traveling staff and shared networks. Subrequest authentication lets a central authorization endpoint decide whether a request may proceed. Combine these controls with application authorization; a network location alone should not grant access to sensitive data.
6. Rate-limit logins, APIs, and connections
Nginx rate limiting can reduce abusive bursts and prevent an upstream from being overwhelmed. Use separate policies for login, API, static, and health endpoints. Account for NAT: limiting by client IP can make hundreds of legitimate users behind one gateway share a bucket.
http {
limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
limit_conn_zone $binary_remote_addr zone=perip:10m;
server {
listen 443 ssl;
server_name app.example.com;
location = /login {
limit_req zone=login burst=5 nodelay;
proxy_pass http://app_backend;
}
location /api/ {
limit_req zone=api burst=20;
limit_conn perip 20;
proxy_pass http://app_backend;
}
}
}The documented 1r/s rate and 10m zone are examples. Measure normal traffic, choose a burst that covers short legitimate spikes, and decide whether excess requests should be delayed or rejected. Apply stricter limits to credential and token endpoints than to cacheable static files. If a trusted load balancer terminates TLS, configure real-client-IP handling explicitly and restrict which proxy addresses may rewrite it; otherwise attackers can evade limits by sending forged forwarding headers.
7. Add browser-enforced security headers
Response headers are browser controls, not a replacement for server-side authorization or input validation. OWASP’s Secure Headers Project documents the purpose and behavior of headers such as Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy, and framing controls.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
server {
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
}
Roll out CSP and HSTS carefully
Start CSP in report-only mode or with a policy derived from the application’s actual scripts, styles, fonts, images, and connections. A policy that omits a required origin can break the application; a policy that allows broad inline execution loses much of its value. Enable HSTS only after every required subdomain works on HTTPS. Add includeSubDomains or submit to a preload list only when you control those hosts permanently.
Choose a framing policy that matches the product. frame-ancestors 'none' blocks embedding; if a trusted parent must embed the app, list only that origin instead. Check headers on redirects and error responses, not just on a successful home page.
8. Bound requests, uploads, and upstream work
Resource exhaustion often comes from oversized bodies, slow headers, long idle connections, or unbounded upstream waits. Set limits appropriate to the application and document exceptions for large uploads.
http {
client_max_body_size 10m;
client_header_timeout 15s;
client_body_timeout 30s;
send_timeout 30s;
proxy_connect_timeout 5s;
proxy_read_timeout 60s;
proxy_send_timeout 60s;
}
These values are starting points, not universal safe numbers. Keep upload endpoints separate when they need larger limits, store uploads outside executable paths, and reject unexpected content types in the application. For proxied HTTPS, make upstream identity and certificate validation explicit rather than assuming an encrypted connection is authenticated.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 119. Log what matters and protect the logs
Record authentication failures, rate-limit events, unexpected methods, upstream errors, and configuration reloads. Send logs to a protected, monitored destination with retention suitable for incident response. Restrict log access because query strings, authorization failures, and application errors can contain personal or secret data. Alert on sudden changes in rejected requests and repeated probes of sensitive paths, but avoid logging credentials or tokens.
10. Verify every change
- Run
nginx -tand stop if syntax or certificate-key loading fails. - Reload through your service manager, then confirm the new worker processes are running.
- From an external client, test HTTP-to-HTTPS redirects, negotiated TLS, certificate validity, and response headers with
curl -I https://app.example.com/. - Exercise authenticated, unauthenticated, allowed, denied, and rate-limited paths.
- Confirm only intended ports are reachable from the Internet and that IPv6 exposure matches your design.
- Review logs for upstream failures, limit events, and unexpected methods.
11. Choose the right deployment model
| Decision axis | Open-source Nginx baseline | Nginx Plus | Front-door WAF/CDN |
|---|---|---|---|
| TLS and certificates | Configure and renew on your hosts | Configure on your hosts with commercial support and expanded controls | Often terminates TLS at the provider; origin certificates and trust still need management |
| Authentication | Basic Auth, subrequest auth, and IP restrictions | Includes documented JWT and OpenID Connect options | Provider identity features vary; application authorization remains necessary |
| Rate-limit scope | Per-worker/shared-zone controls at Nginx | Expanded traffic controls and management features | Can absorb traffic before origin, subject to provider policy and plan |
| Dynamic denylisting | Usually requires your own automation | Documented dynamic denylisting capabilities | Often available as a managed edge feature |
| Observability | Your logs, metrics, and alerting | Commercial monitoring and management features | Provider dashboards plus origin logs |
| Failure behavior | You design fail-open/fail-closed behavior | Depends on the Plus components you deploy | Depends on provider and origin failover configuration |
| Operational complexity | Lowest licensing cost, highest responsibility | More capability with a commercial license | Less edge operation, more dependency on a third party |
| Compatibility | Best when you control the host and traffic path | Useful when built-in identity and traffic controls justify the license | Useful when global edge filtering or WAF functions are required |
No authoritative source establishes a universal breach-reduction percentage or throughput penalty for these choices. Select based on your application, trust boundaries, failure requirements, and ability to operate each layer.
Rank #4
12. Troubleshooting common hardening failures
nginx -t reports a certificate or key error
Check the certificate and key paths, file permissions, chain file, and whether the key is readable by the Nginx master process. A restrictive mode is useful only if the service account can still read the key.
Legitimate users receive 429 responses
Inspect the limit zone, burst, and client-IP variable. Shared NAT, mobile carriers, or a misconfigured trusted proxy can collapse many users into one bucket. Correct real-client-IP handling and create endpoint-specific limits rather than simply raising every limit.
CSP breaks scripts or embedded content
Use browser violation reports or a report-only policy to identify required origins, then narrow the policy deliberately. Avoid adding a broad wildcard just to silence errors.
Security headers disappear on errors or redirects
Use the always parameter where appropriate and test each response class. Also check whether an upstream or CDN replaces Nginx headers.
Rate limiting appears ineffective
Confirm requests reach the intended location block, the shared-memory zone is defined in the http context, and the address key reflects the real client. Review logs for limit events and test from outside the trusted proxy path.
Upgrades change behavior
Compare nginx -V output and enabled modules before and after the package change, validate the full configuration, and keep the prior package and configuration available for rollback.
Recommended Free Tools
Or skip the browser setup
When you need a repeatable visual check of an externally reachable page after changing Nginx headers, redirects, or authentication, ScreenshotNeo can return a screenshot or PDF through one request. Its cleanup step accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and the response identifies the page verdict and billing status in X-Page-Verdict and X-Billed headers. An MCP server exposes take_screenshot, get_page_info, and capture_pdf to Claude, Cursor, and other MCP clients.
Use the ScreenshotNeo API documentation for all options, including full-page lazy-image capture, CSS-selector element capture, dark mode, device presets and custom viewports, retina scale, PDF paper and page settings, custom CSS and JavaScript, click and wait actions, request blocking, headers, cookies, user agents, authorization, timezone, geolocation, transparent backgrounds, resizing, configurable caching, signed image links, asynchronous webhooks, bulk capture of up to 100 URLs per call, usage reporting, and the OpenAPI specification.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpimport requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);The Free plan includes 1,000 screenshots per month with no card. Paid plans start at $5 for 3,000 shots; every feature is included on every plan, and yearly billing gives two months free. Create a free ScreenshotNeo account to run the first check without adding a card.
Frequently Asked Questions
Can Nginx rate limiting replace a DDoS service?
No. It can constrain abusive requests and protect an upstream, but capacity is still limited by your host and network. Use an upstream mitigation or edge service when attacks can saturate the link before traffic reaches Nginx.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Should every site enable HSTS preload immediately?
No. First verify that the main domain and every subdomain that will inherit the policy works permanently over HTTPS. Add includeSubDomains or pursue preload only after that review.
Are security headers enough to secure an application?
No. They influence browser behavior. Authentication, authorization, input validation, patching, secret handling, logging, and upstream security remain application and server responsibilities.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
