StackPrism

Production checklist

NGINX production checklist: 5 checks before launch

5 checks for running NGINX in production: 2 should-dos and 3 good-to-haves. Each one says why it matters, how to verify it and where the docs are.

Updated . Every check links the vendor’s own docs.

Check my repo

Should do (2)

  • Serve HTTPS only with modern TLS settings

    Redirect HTTP to HTTPS and disable old protocols.

    Verify from the command line

    Plain HTTP should redirect to HTTPS, and only TLS 1.2 and 1.3 should be enabled.

    curl -sI http://<your-domain> | head -3
sudo nginx -T | grep ssl_protocols

    Read more on nginx.org

  • Add security headers with add_header … always

    Without always they’re skipped on error pages, and an add_header in a location block drops the server-level ones.

    Verify with a request

    The headers should be present on normal pages and on error pages (request a URL that 404s too).

    curl -sI https://<your-domain>/does-not-exist | grep -iE "strict-transport-security|x-content-type-options|x-frame-options"

    Read more on nginx.org

Good to have (3)

  • Rate-limit login and API routes

    Slows down credential stuffing and scraping.

    Check the config

    The login location has a limit_req zone. Hammering it should start returning 503 (or 429 if you set limit_req_status 429).

    limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
location /login {
    limit_req zone=login burst=5;
}

    Read more on nginx.org

  • Hide the version number (server_tokens off)

    The version in every response tells attackers which exploits to try.

    Verify with a request

    The Server header should say nginx without a version number.

    curl -sI https://<your-domain> | grep -i "^server"

    Read more on nginx.org

  • Set client_max_body_size and client timeouts for your traffic

    Caps upload size and drops slow clients that would otherwise hold connections open.

    Verify from the command line

    client_max_body_size and the client timeouts are set for your largest real upload, not left at defaults you didn’t choose.

    sudo nginx -T | grep -E "client_max_body_size|client_body_timeout|client_header_timeout"

    Read more on nginx.org

Get the checklist for your whole stack

Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.

Vibe coding security checklistMap my repo