Category: security

Securing Nginx and PHP

A practical guide to hardening Nginx and PHP-FPM on a single-admin server: user separation, SSH key authentication, connection limits, rate limiting, and PHP configuration defaults that won't get you compromised.

Rate Limiting with Nginx's limit_req

Use Nginx's limit_req module to protect your site from HTTP floods and brute-force attacks — with real-world examples for static pages, PHP handlers, and login endpoints.

Protecting Folders with Nginx

Basic authentication in Nginx is a quick way to gate a directory, an admin area, or an entire staging site behind a username and password. It's not a replacement for a full login system, but for internal tools, dev environments, or adding a second layer in front of something already protected, it does the job with almost no overhead.

Nginx "ssl_stapling" ignored With LetsEncrypt Certbot (2025)

If you are seeing this error this month (May 2025) and have tried searching the web for a fix you will find that there will be no fix that keeps SSL Stapling enabled. LetsEncrypt no longer includes OCSP URLs. Here's how to update your configuration.