Published on

Nginx Security: How to Get an A+ Rating in 2026

The best Nginx configuration for security involves disabling outdated protocols like TLS 1.0 and 1.1, enforcing strong AES-256-GCM encryption, and implementing a strict Content Security Policy (CSP). By applying these settings to Nginx 1.30+ on a modern server like Ubuntu 26.04 LTS, you can achieve an A+ security rating and protect your users from 99% of common web attacks in under 15 minutes.

What You'll Need

  • A server running Ubuntu 26.04 LTS (the current Long Term Support version).
  • Nginx 1.30 or higher installed (the stable mainline version for 2026).
  • A registered domain name with an active SSL certificate (Secure Sockets Layer - the technology that encrypts the connection between a browser and a server).
  • Basic familiarity with the command line (the text-based interface used to control your server).

Why is default Nginx not secure enough?

When you first install Nginx, it prioritizes compatibility over maximum security. This means it might allow older browsers to connect using weak encryption methods that hackers can easily break.

Default settings often reveal your Nginx version number to the public. If a new vulnerability (a weakness in the software) is discovered for that specific version, attackers can find you more easily.

Standard configurations also lack modern security headers (instructions sent from the server to the browser). These headers are essential for preventing modern attacks like clickjacking or data injection.

Which SSL settings provide the best protection?

To keep your data safe, you must move away from older standards. You should only allow TLS 1.2 and TLS 1.3 (Transport Layer Security - the modern, more secure versions of SSL).

We've found that using AES-256-GCM encryption provides the best balance of high-level security and performance on modern hardware. This specific algorithm ensures that even if someone intercepts your data, they cannot read it without a massive amount of computing power.

You should also implement a Diffie-Hellman group (a way for two parties to agree on a secret key over a public channel) with at least 4096 bits. This makes the initial "handshake" between the browser and your server much harder to crack.

How do you hide your server identity?

The first step in hardening (the process of securing a system by reducing its surface of vulnerability) is to stop talking so much. By default, Nginx tells everyone exactly what software you are running.

Open your main configuration file, usually located at /etc/nginx/nginx.conf. You can use a text editor like Nano (a simple, beginner-friendly terminal editor) to do this.

Find the http block and add the line server_tokens off;. This simple change prevents Nginx from displaying its version number on error pages or in the server headers.

Step 1: Generating strong encryption keys

Before touching the Nginx config, you need to generate a strong DH (Diffie-Hellman) parameter file. This provides extra security during the key exchange process.

Run this command in your terminal:

# This creates a 4096-bit key file
# It may take several minutes to complete
sudo openssl dhparam -out /etc/nginx/dhparam.pem 4096

What you should see: The terminal will output dots and plus signs for a few minutes. Once it finishes, you will have a new file named dhparam.pem in your Nginx folder.

Step 2: Configuring the SSL block

Now, you need to tell Nginx to use the highest security standards. Locate your site's configuration file (often in /etc/nginx/sites-available/default).

Replace your existing SSL settings with these lines:

# Only allow modern, secure protocols
ssl_protocols TLSv1.2 TLSv1.3;

# Use high-strength encryption ciphers
ssl_ciphers 'ECDHE-ECDSA-AES-256-GCM-SHA384:ECDHE-RSA-AES-256-GCM-SHA384';
ssl_prefer_server_ciphers on;

# Link to the DH file you created in Step 1
ssl_dhparam /etc/nginx/dhparam.pem;

# Enable HSTS (Strict Transport Security)
# This forces browsers to only use HTTPS for one year
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

What you should see: These settings ensure that if a browser tries to use a weak connection, Nginx will refuse it. This keeps your users safe from "downgrade attacks."

Step 3: Adding modern security headers

Security headers tell the browser how to behave when handling your site's content. These are your best defense against modern web threats.

Add these lines inside your server block:

# Prevent the site from being embedded in an iframe (prevents Clickjacking)
add_header X-Frame-Options "SAMEORIGIN";

# Prevent the browser from guessing the content type (prevents MIME-sniffing)
add_header X-Content-Type-Options "nosniff";

# Content Security Policy (CSP)
# This tells the browser only to load scripts from your own domain
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";

What you should see: These headers act as a shield. Even if a hacker manages to inject a malicious script into your site, the CSP (Content Security Policy) will tell the browser not to run it.

Step 4: Testing your new configuration

Never restart Nginx without testing the configuration first. A single missing semicolon can take your entire website offline.

Run the following command:

# Check for syntax errors in your config files
sudo nginx -t

What you should see: You should see a message saying syntax is ok and test is successful. If you see an error, the message will tell you exactly which line is causing the problem.

Step 5: Applying the changes

Once the test passes, you can safely apply the new security settings. This will restart the Nginx service with your updated rules.

Run this command:

# Reload the service to apply changes without dropping connections
sudo systemctl reload nginx

What you should see: There won't be a specific output if it works. You can verify your site is still running by visiting it in your browser and looking for the padlock icon.

Common Gotchas and Troubleshooting

Don't worry if your site suddenly stops working for very old devices, like a smartphone from 2014. This happens because we disabled older protocols (TLS 1.0/1.1) that those devices require.

If you get a "403 Forbidden" error, it's normal to check your file permissions first. However, in security hardening, this often means your CSP (Content Security Policy) is too strict and is blocking a script your site needs to function.

If the nginx -t command fails, look closely at the end of each line in your config file. Beginners often forget the semicolon (;) at the end of a directive, which is the most common cause of Nginx errors.

Next Steps

Now that your Nginx server is locked down, you should consider setting up a firewall like UFW (Uncomplicated Firewall) to limit who can connect to your server. You might also want to look into Fail2Ban, which automatically blocks IP addresses that show suspicious behavior.

To learn more about advanced Nginx features and modules, check out the official Nginx documentation.

Read the Nginx Documentation