@Desain,

To harden your Nginx server, you’ll also want to:

1. Keep Nginx and system packages updated
2. Use a firewall (UFW/iptables) to only allow needed ports (80, 443, SSH).
3. Set up Fail2Ban or similar to block brute-force or malicious requests.
4. Configure strong SSL/TLS settings disable old protocols (SSLv3, TLS 1.0/1.1) and weak ciphers.
5. Add security headers like Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Content-Security-Policy.
6. Enable rate limiting to slow down bots and prevent abuse.
7. Run Nginx as a non-root user and use least privilege for services.
8. Monitor logs for unusual activity and consider setting up alerts.

This way, you’re covering both encryption and server hardening, which together give you much stronger protection.

Thank you!

@Alexey

Certbot automatically renews the SSL certificate 30 days prior to its expiration. To verify the renewal process, run the command below.

$ sudo certbot renew --dry-run

How to upgrade automatically certificate every three months on the schedule? How to write correctly a script?