GITHUB SNAPSHOT

trimstray/nginx-admins-handbook

TopGit repo profile for trimstray/nginx-admins-handbook, with GitHub repository stats and README context.

Stars

★ 14.3k

Forks

⑂ 1.1k

Language

Shell

Topic

Security

License

MIT

Updated

1.7y ago

Contributors

👥 14

Homepage

—

View on GitHub ↗

QUICK VERDICT

trimstray/nginx-admins-handbook is a Security project on GitHub, written primarily in Shell. It has 14.3k stars. How to improve NGINX performance, security, and other important things.

Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.

WHY NO REVIEW YET

TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.

Snapshot

Stars★ 14.3k

Forks⑂ 1.1k

LanguageShell

TopicSecurity

LicenseMIT

Homepage—

Read our review methodology ↗

Top contributors

Show top contributors

Top 21 contributors to trimstray/nginx-admins-handbook

NAME	AMOUNT	DESCRIPTION
critical	33	definitely use this rule, otherwise it will introduce high risks of your NGINX security, performance, and other
major	26	it's also very important but not critical, and should still be addressed at the earliest possible opportunity
normal	12	there is no need to implement but it is worth considering because it can improve the NGINX working and functions
minor	8	as an option to implement or use (not required)

RULE	CHAPTER	PRIORITY
Define the listen directives with address:port pair ^{Prevents soft mistakes which may be difficult to debug.}	Base Rules
Prevent processing requests with undefined server names ^{It protects against configuration errors, e.g. traffic forwarding to incorrect backends.}	Base Rules
Never use a hostname in a listen or upstream directives ^{While this may work, it will comes with a large number of issues.}	Base Rules
Set the HTTP headers with add_header and proxy_*_header directives properly ^{Set the right security headers for all contexts.}	Base Rules
Configure log rotation policy ^{Save yourself trouble with your web server: configure appropriate logging policy.}	Base Rules
Use simple custom error pages ^{Default error pages reveals information which leads to information leakage vulnerability.}	Base Rules
Use HTTP/2 ^{HTTP/2 will make our applications faster, simpler, and more robust.}	Performance
Always keep NGINX up-to-date ^{Use newest NGINX package to fix vulnerabilities, bugs, and to use new features.}	Hardening
Run as an unprivileged user ^{Use the principle of least privilege. This way only master process runs as root.}	Hardening
Protect sensitive resources ^{Hidden directories and files should never be web accessible.}	Hardening
Take care about your ACL rules ^{Test your access-control lists and to stay secure.}	Hardening
Hide upstream proxy headers ^{Don't expose what version of software is running on the server.}	Hardening
Remove support for legacy and risky HTTP request headers ^{Supports for the offending headers should be removed.}	Hardening
Force all connections over TLS ^{Protects your website for handle sensitive communications.}	Hardening
Use min. 2048-bit for RSA and 256-bit for ECC ^{2048 bit (RSA) or 256 bit (ECC) keys are sufficient for commercial use.}	Hardening
Keep only TLS 1.3 and TLS 1.2 ^{Use TLS with modern cryptographic algorithms and without protocol weaknesses.}	Hardening
Use only strong ciphers ^{Use only strong and not vulnerable cipher suites.}	Hardening
Use more secure ECDH Curve ^{Use ECDH Curves with according to NIST recommendations.}	Hardening
Use strong Key Exchange with Perfect Forward Secrecy ^{Establishes a shared secret between two parties that can be used for secret communication.}	Hardening
Defend against the BEAST attack ^{The server ciphers should be preferred over the client ciphers.}	Hardening
Enable HTTP Strict Transport Security ^{Tells browsers that it should only be accessed using HTTPS, instead of using HTTP.}	Hardening
Reduce XSS risks (Content-Security-Policy) ^{CSP is best used as defence-in-depth. It reduces the harm that a malicious injection can cause.}	Hardening
Control the behaviour of the Referer header (Referrer-Policy) ^{The default behaviour of referrer leaking puts websites at risk of privacy and security breaches.}	Hardening
Provide clickjacking protection (X-Frame-Options) ^{Defends against clickjacking attack.}	Hardening
Prevent some categories of XSS attacks (X-XSS-Protection) ^{Prevents to render pages if a potential XSS reflection attack is detected.}	Hardening
Prevent Sniff Mimetype middleware (X-Content-Type-Options) ^{Tells browsers not to sniff MIME types.}	Hardening
Reject unsafe HTTP methods ^{Only allow the HTTP methods for which you, in fact, provide services.}	Hardening
Prevent caching of sensitive data ^{It helps to prevent critical data (e.g. credit card details, or username) leaked.}	Hardening
Limit concurrent connections ^{Limit concurrent connections to prevent a rogue guys from repeatedly connecting to and monopolizing NGINX.}	Hardening
Use pass directive compatible with backend protocol ^{Set pass directive only to working with compatible backend layer protocol.}	Reverse Proxy
Set properly values of the X-Forwarded-For header ^{Identify clients communicating with servers located behind the proxy.}	Reverse Proxy
Don't use X-Forwarded-Proto with $scheme behind reverse proxy ^{Prevent pass incorrect value of this header.}	Reverse Proxy
Always use $request_uri instead of $uri in proxy_pass ^{You should always pass unchanged URI to the backend layer.}	Reverse Proxy
Organising Nginx configuration ^{Well organised code is easier to understand and maintain.}	Base Rules
Format, prettify and indent your Nginx code ^{Formatted code is easier to maintain, debug, and can be read and understood in a short amount of time.}	Base Rules
Use reload option to change configurations on the fly ^{Graceful reload of the configuration without stopping the server and dropping any packets.}	Base Rules
Use return directive for URL redirection (301, 302) ^{The by far simplest and fastest because there is no regexp that has to be evaluated.}	Base Rules
Maintaining SSL sessions ^{Improves performance from the clients’ perspective.}	Performance
Enable OCSP Stapling ^{Enable to reduce the cost of an OCSP validation.}	Performance
Use exact names in a server_name directive if possible ^{Helps speed up searching using exact names.}	Performance
Avoid checks server_name with if directive ^{It decreases NGINX processing requirements.}	Performance
Use $request_uri to avoid using regular expressions ^{By default, the regex is costly and will slow down the performance.}	Performance
Use try_files directive to ensure a file exists ^{Use it if you need to search for a file, it saving duplication of code also.}	Performance
Use return directive instead of rewrite for redirects ^{Use return directive to more speedy response than rewrite.}	Performance
Enable PCRE JIT to speed up processing of regular expressions ^{NGINX with PCRE JIT is much faster than without it.}	Performance
Activate the cache for connections to upstream servers ^{Nginx can now reuse its existing connections (keepalive) per upstream.}	Performance
Disable unnecessary modules ^{Limits vulnerabilities, improve performance and memory efficiency.}	Hardening
Hide Nginx version number ^{Don't disclose sensitive information about NGINX.}	Hardening
Hide Nginx server signature ^{Don't disclose sensitive information about NGINX.}	Hardening
Use only the latest supported OpenSSL version ^{Stay protected from SSL security threats and don't miss out of new features.}	Hardening
Prevent Replay Attacks on Zero Round-Trip Time ^{0-RTT is disabled by default but you should know that enabling this option creates a significant security risks.}	Hardening
Mitigation of CRIME/BREACH attacks ^{Disable HTTP compression or compress only zero sensitive content.}	Hardening
Deny the use of browser features (Feature-Policy) ^{A mechanism to allow and deny the use of browser features.}	Hardening
Control Buffer Overflow attacks ^{Prevents errors are characterised by the overwriting of memory fragments of the NGINX process.}	Hardening
Mitigating Slow HTTP DoS attacks (Closing Slow Connections) ^{Prevents attacks in which the attacker sends HTTP requests in pieces slowly.}	Hardening
Set and pass Host header only with $host variable ^{Use of the $host is the only one guaranteed to have something sensible.}	Reverse Proxy
Always pass Host, X-Real-IP, and X-Forwarded headers to the backend ^{It gives you more control of forwarded headers.}	Reverse Proxy
Set the certificate chain correctly ^{Send the complete chain to the client.}	Others
Enable DNS CAA Policy ^{Allows domain name holders to indicate to CA whether they are authorized to issue digital certificates.}	Others
Separate listen directives for 80 and 443 ports ^{Help you maintain and modify your configuration.}	Base Rules
Use only one SSL config for the listen directive ^{Prevents multiple configurations on the same listening address.}	Base Rules
Use geo/map modules instead of allow/deny ^{Provides the perfect way to block invalid visitors.}	Base Rules
Set global root directory for unmatched locations ^{Specifies the root directory for an undefined locations.}	Base Rules
Don't duplicate index directive, use it only in the http block ^{Watch out for duplicating the same rules.}	Base Rules
Adjust worker processes ^{You can adjust this value to maximum throughput under high concurrency.}	Performance
Make an exact location match to speed up the selection process ^{Exact location matches are often used to speed up the selection process.}	Performance
Use limit_conn to improve limiting the download speed ^{Limits NGINX download speed per connection.}	Performance
Be careful with trailing slashes in proxy_pass directive ^{Incorrect setting could end up with some strange url.}	Reverse Proxy
Use custom headers without X- prefix ^{The use of custom headers with X- prefix is discouraged.}	Reverse Proxy
Tweak passive health checks ^{Improve behaviour of the passive health checks.}	Load Balancing
Define security policies with security.txt ^{Helps make things easier for companies and security researchers.}	Others
Map all the things... ^{Map module provides a more elegant solution for clearly parsing a big list of regexes.}	Base Rules
Use custom log formats ^{This is extremely helpful for debugging specific location directives.}	Debugging
Use debug mode to track down unexpected behaviour ^{There's probably more detail than you want, but that can sometimes be a lifesaver.}	Debugging
Improve debugging by disable daemon, master process, and all workers except one ^{This simplifies the debugging and lets test configurations rapidly.}	Debugging
Use core dumps to figure out why NGINX keep crashing ^{Enable core dumps when your NGINX instance receive an unexpected error or when it crashed.}	Debugging
Use mirror module to copy requests to another backend ^{Use mirroring for investigation and debugging of any original request.}	Debugging
Don't disable backends by comments, use down parameter ^{Is a good solution to marks the server as permanently unavailable.}	Load Balancing
Use tcpdump to diagnose and troubleshoot the HTTP issues ^{Use tcpdump to monitor HTTP.}	Others

Related repositories

FREQUENTLY ASKED

Quick answers

How does trimstray/nginx-admins-handbook compare to other Security projects?

trimstray/nginx-admins-handbook is tracked by TopGit in the Security category, with 14.3k GitHub stars and written in Shell. Browse the Security topic page on TopGit to compare it against similar projects by stars and activity.

Is trimstray/nginx-admins-handbook open source?

Yes — trimstray/nginx-admins-handbook ships under the MIT license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/trimstray/nginx-admins-handbook.

What else is in the Security space?

trimstray/nginx-admins-handbook is tracked by TopGit under the Security category, alongside 17 GitHub-tagged topics. Trending and Topics pages list peer repositories of comparable stars and language.

What is trimstray/nginx-admins-handbook?

trimstray/nginx-admins-handbook (trimstray/nginx-admins-handbook) is a Shell project on GitHub. From the project's own README: How to improve NGINX performance, security, and other important things.

Where do I read more about trimstray/nginx-admins-handbook?

This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/trimstray/nginx-admins-handbook is the definitive source.

Why is trimstray/nginx-admins-handbook categorized under Security?

TopGit places trimstray/nginx-admins-handbook in the Security category based on its GitHub topics and description (tagged: "best-practices", "cheatsheet", "hacks"). Categories are assigned from real repository metadata, not editorial guesswork.

Read full README in the tab above.

Snapshot

Top contributors

Nginx Admin's Handbook

Table of Contents

Introduction

Prologue

Why I created this handbook

Who this handbook is for

Before you start

Contributing & Support

Code Contributors

ToDo

RSS Feed & Updates

Checklist to rule them all

Bonus Stuff

Configuration reports

SSL Labs

Mozilla Observatory

Printable hardening cheatsheets

Fully automatic installation

Static error pages generator

Server names parser

Books

Nginx Essentials

Nginx Cookbook

Nginx HTTP Server

Nginx High Performance

Mastering Nginx

ModSecurity 3.0 and NGINX: Quick Start Guide

Cisco ACE to NGINX: Migration Guide

External Resources

Nginx official

Nginx distributions

Comparison reviews

Cheatsheets & References

Performance & Hardening

Presentations & Videos

Playgrounds

Config generators

Config parsers

Config managers

Static analyzers

Log analyzers

Performance analyzers

Builder tools

Benchmarking tools

Debugging tools

Security & Web testing tools

Development

Online & Web tools

Other stuff

What's next?

Related repositories

Quick answers