DocSwift
DevOps & SysadminUpdated: 2026-11-07

The Essential Nginx Configuration Cheat Sheet: Reverse Proxy, SSL & Security Headers

Quick reference for reverse proxy blocks, Let's Encrypt SSL/TLS hardening, rate limiting, and HTTP security headers.

Nginx powers a significant share of the world’s web traffic as a high-performance HTTP server, reverse proxy, and load balancer. Keep this cheat sheet handy for configuring reverse proxies, SSL/TLS, and security headers.

Table of Contents

CLI Management & Health ChecksProduction Reverse Proxy Server BlockSecurity Headers & Gzip Compression

CLI Management & Health Checks

Essential terminal commands for operating Nginx without downtime.

CommandActionDescription
`nginx -t`Syntax VerificationTests configuration files for syntax errors and unclosed brackets before reloading.
`nginx -s reload`Zero-Downtime ReloadGracefully re-reads configuration files without terminating active client connections.
`systemctl status nginx`Daemon StatusInspects systemd worker processes, memory consumption, and runtime errors.

Production Reverse Proxy Server Block

Standard block proxying incoming traffic to local application servers.

Reverse Proxy with SSL & WebSocketsnginx
server {
    listen 80;
    server_name api.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Security Headers & Gzip Compression

Hardening response headers and shrinking text payload sizes.

Security Headers & Gzipnginx
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css application/json application/javascript text/xml;

Interactive Client-Side Tools for this Guide

Test and run these patterns directly inside your browser with zero server uploads:

cURL to Fetch, Axios & Python Code Converter

Paste raw cURL commands from browser DevTools and instantly convert them into clean JavaScript, Python, or Go code snippets.

Open Tool

Private Online JWT Debugger & Token Inspector

Safely inspect and decode JSON Web Tokens with zero cloud transmission. Verify expiration countdowns, claims, and HMAC signatures in complete privacy.

Open Tool

URL Encoder & Decoder (Percent Encoding)

Easily encode query strings, parameter values, and special symbols for REST APIs, web scrapers, and browser links.

Open Tool

Frequently Asked Questions

Why does proxy_pass with a trailing slash behave differently?

When a trailing slash is present (proxy_pass http://backend/;), Nginx strips the matching location URI prefix. Without the trailing slash, the full original request URI is forwarded.

How do I prevent clients from uploading files larger than 10MB?

Add `client_max_body_size 10M;` to your http or server configuration block.

Back to All Cheat Sheets