The answer
Use allow and deny directives in the location block: allow 192.168.1.0/24; deny all; This only allows requests from the specified IP range. For basic auth, use auth_basic and auth_basic_user_file with htpasswd.
Nginx Security Hardening Protecting Your Node.js App from Attacks
How do I restrict access to admin routes by IP?
More FAQs in Nginx Security Hardening Protecting Your Node.js App from Attacks
Add server_tokens off; to nginx.conf. This removes the version number from the Server response header and error pages, making it harder for attackers to identify known vulnerabilities in your specific Nginx version.
X-Frame-Options (SAMEORIGIN, prevents clickjacking), X-Content-Type-Options (nosniff, prevents MIME sniffing), X-XSS-Protection, Referrer-Policy, Content-Security-Policy (restricts resource loading), and Strict-Transport-Security (HSTS, forces HTTPS).
Set client_max_body_size to limit payload size, short timeouts (client_body_timeout 10, client_header_timeout 10) to prevent slowloris attacks, rate limiting (limit_req_zone with rate and burst), and connection limits (limit_conn_zone).
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.