Secure Nginx Server

Overview

Quick tips to improve the security of an nginx web server.

Avoid giving nginx info

Disables specifying nginx’s version on error pages and in the Server response header field disabling server_tokens.

In /etc/nginx/nginx.conf:

http {
	server_tokens off;
	# ...
	}

Audit with third-party app

Install wapiti

sudo apt-get install wapiti

and test your site:

wapiti http://example.org -n 10 -b folder