This could lead to information disclosure – an unauthorized user could gain knowledge about the version of nginx that you use. It is directly visible in all automatically generated error pages but also present in all HTTP responses in the Server header. configure -without-http_autoindex_moduleīy default, the server_tokens directive in nginx displays the nginx version number. In the example below, we disable the autoindex module, which generates automatic directory listings, and then recompile nginx. To do this, use the configure option during installation. We recommend that you disable any modules that are not required as this will minimize the risk of potential attacks by limiting allowed operations. To disable certain modules, you need to recompile nginx. Currently, you cannot choose modules at runtime. When you install nginx, it automatically includes many modules. You may also need to do some changes to virtual host configuration files, typically contained in the sites-available subdirectory. By default, you can find nf in /conf on Windows systems, and in /etc/nginx or /usr/local/etc/nginx on Linux systems. This is the main configuration file for nginx and therefore most security checks will be done using this file. In this article, we will provide tips on nginx server security, showing you how to secure your nginx installation.Īfter installing nginx, you should gain a good understanding of its configuration settings, which are found in the nf file. An nginx server can easily handle 10,000 inactive HTTP connections with as little as 2.5 MB of memory. It is the web server of choice for Netflix,, and other high traffic sites. It is lightweight, fast, robust, and supports all major operating systems. Currently, nginx is the most popular web server, recently beating Apache.

Apache webdav max file size