Summary

​

HTTPS and redirects

• Always serve sites over HTTPS whenever possible. Modern browsers may block or warn users about insecure HTTP pages and many web platform features require HTTPS.
• Redirect plain http:// traffic to https:// at the proxy or web server level so users always receive the encrypted site.
• Use HSTS (HTTP Strict Transport Security) to tell browsers to always connect over HTTPS after the first secure visit.

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

​

SSL vs TLS and certificate sources

• TLS is the modern protocol that replaced the deprecated SSL family. People still say “SSL” colloquially, but TLS is the current, secure standard.
• For local development, use mkcert to create locally trusted certificates. It installs a local CA into your machine so your browser trusts development certs.
• For public-facing sites, obtain certificates from a trusted CA such as Let’s Encrypt (free) or commercial CAs like DigiCert and Comodo.

​

HTTP headers and reverse-proxy behavior

• Common proxy-forwarded headers:
  • X-Forwarded-For — original client IP
  • X-Forwarded-Proto — original protocol (http or https)
  • Host — requested host header
• Make sure your backend application trusts and correctly parses these headers (or use a trusted proxy with header rewriting features).

​

Authentication: auth_basic and robust alternatives

• NGINX auth_basic (HTTP Basic Auth) is simple to set up and useful for internal, staging, or temporary protection.
• For public-facing apps, prefer stronger, auditable authentication methods such as OAuth2, OpenID Connect, or SSO providers integrated with your app or identity provider.

​

Access control: allow/deny vs scalable protections

• NGINX allow/deny directives are convenient for small, static IP-based access lists (for example, allowing a management subnet).
• These rules do not scale well when you have many IPs or frequently changing lists.
• For larger deployments, use centralized, scalable solutions:
  • Network firewalls and ACLs
  • Web Application Firewalls (WAF)
  • Automated blocklists or dynamic tools like Fail2Ban to detect abuse and update firewall rules

​

Operational recommendations

• Enforce TLS and implement strong HSTS policies once ready.
• Set comprehensive security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
• Ensure the reverse proxy forwards the correct X-Forwarded-* headers and your backend validates them.
• Use automated tooling:
  • Let’s Encrypt (ACME) for certificate issuance and automated renewal
  • Fail2Ban, WAF, or cloud security services for blocking abuse
  • Infrastructure-as-code (Terraform, CloudFormation) for reproducible network and firewall rules

​

Quick checklist

• Serve all production sites over HTTPS
• Redirect HTTP to HTTPS at the proxy/web server
• Use trusted certificates and automate renewals
• Configure HSTS after verifying all subdomains support HTTPS
• Harden with security headers and validate them in staging
• Prefer OAuth/OpenID Connect for public authentication
• Use scalable access controls for large or dynamic environments
• Automate detection and blocking of abusive traffic (Fail2Ban/WAF)

​

Links and references

• mkcert — GitHub
• Let’s Encrypt
• Fail2Ban
• Kubernetes Documentation