Why Your Nginx Server Gets Hit Constantly

The moment your server has a public IP, it becomes a target for automated scanners, botnets, and exploit attempts. These aren’t necessarily personal attacks - they’re just bots sweeping the internet looking for weak configurations. A reverse proxy like Nginx sits at the front of your entire stack, so securing it is one of the most important steps you can take.

Strengthening Nginx With Simple, Safe Hardening

You don’t need an enterprise firewall or complex WAF (Web Application Firewall) to make your server significantly safer. A few small changes to your Nginx configuration can reduce noise, slow down attackers, and protect your backend services.

Config example of nginx.conf


user  nginx;
worker_processes  auto;
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events { 
    worker_connections 1024; 
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    tcp_nopush      on;
    keepalive_timeout 65;
    server_tokens off;
    client_max_body_size 200M;


    # rate limiting, throw-away people at more than 5 pr second
    limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;

    # include per-site configs
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/conf.d/catchall/000-catchall.conf;
}

Disable Server Tokens

Nginx normally reveals its version number in responses. Attackers use this to identify vulnerable versions. server_tokens off; This hides unnecessary information and reduces fingerprinting.

Limit Request Body Size

Large payloads can be used for denial‑of‑service attempts or to exploit upload endpoints. client_max_body_size 200M; Adjust the value to match your needs. If you don’t accept large uploads, lower it. A common default is 1M, but if you have a file upload service, you may need to increase it.

Add Basic Rate Limiting

Rate limiting is one of the most effective protections you can add without breaking anything. It slows down bots and prevents rapid‑fire exploit attempts. 
limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
Then inside your server block: 
limit_req zone=one burst=10 nodelay;
The server block can be your main reverse proxy or a specific site. The burst parameter allows short bursts of traffic, while nodelay ensures that requests beyond the limit are rejected immediately. This would be in the config files, like /etc/nginx/conf.d/catchall/000-catchall.conf. Redirect example.com to your main site, and apply rate limiting to all requests hitting this catch‑all. 

# HTTP catch‑all redirect
server {
    listen 80 default_server;
    server_name _;

    return 301 https://example.com$request_uri;
}

# HTTPS catch‑all redirect
server {
    listen 443 ssl default_server;
    server_name _;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Rate limiting applied to all requests hitting this catch‑all
    limit_req zone=one burst=10 nodelay;

    return 301 https://example.com$request_uri;
}
What this does:
  • Allows 5 requests per second per IP
  • Allows short bursts of 10 requests
  • Rejects excessive traffic with a 429 error (Too Many Requests)
Normal users never notice it. Bots hit a wall immediately.

Use a Catch‑All Server Block

A catch‑all prevents attackers from probing random hostnames on your IP. 

server {
    listen 80 default_server;
    return 444;

    # Rate limiting applied to all requests hitting this catch‑all
    limit_req zone=one burst=10 nodelay;
}
The 444 status closes the connection without responding - a quiet way to drop junk traffic. Create a config file like /etc/nginx/conf.d/catchall/000-catchall.conf and include it in your main nginx.conf.

Keep Your Includes Organized

Your reverse proxy likely uses multiple site configs. Keeping them in /etc/nginx/conf.d/ ensures each service stays isolated and easy to manage. 

include /etc/nginx/conf.d/*.conf;
include /etc/nginx/conf.d/catchall/000-catchall.conf;
This structure keeps your main nginx.conf clean and avoids accidental breakage.

Optional Enhancements That Don’t Break Proxying

These are safe to add but not required.

Security Headers

These headers reduce browser‑based attack surfaces without affecting your upstream services.
  • X-Frame-Options - Controls whether the browser should allow a page to be displayed in a frame
  • X-Content-Type-Options - Prevents the browser from MIME-sniffing the content type
  • X-XSS-Protection - Enables XSS filtering in the browser
  • Referrer-Policy - Controls how much referrer information is sent with requests
They’re harmless and improve overall security posture.

Cloudflare or Another CDN

Putting Cloudflare in front of your server:
  • Hides your real IP
  • Blocks botnets before they reach you
  • Provides free DDoS protection
  • Reduces attack noise dramatically
This is one of the most impactful upgrades you can make.

Finally

Securing Nginx doesn’t require complex tools or deep networking knowledge. A few small changes - rate limiting, hiding server tokens, using a catch‑all, and organizing your configs - can dramatically reduce malicious traffic and protect your backend services.