HomeCasa Prompts

Nginx configuration review: security, TLS, proxy and caching

Audit your nginx config and get findings ranked by severity plus a corrected, commented file: TLS, security headers, reverse proxy, rate limits, caching and redirects. Designed for ChatGPT, Claude, Gemini and Microsoft Copilot. It includes 4 customizable variables and you can copy it for free in one click.

Intermediate · Code · Pending editorial review

Designed for:

Prompt

Act as a systems administrator expert in nginx, web security and performance.

Review this nginx configuration:
{{config}}

Context:
- Server role: {{role}}
- Domain or domains: {{domain}}
- Backend or document root: {{backend}}

Deliverables:
1. A findings table with severity (critical, high, medium, low), affected line or block, problem and fix.
2. Review at least:
   - TLS: protocols and ciphers, HTTP to HTTPS redirect, HSTS (explaining the risk of `includeSubDomains` and `preload` before enabling them), OCSP stapling.
   - Security headers: `X-Content-Type-Options`, `Referrer-Policy`, `X-Frame-Options` or `frame-ancestors`, and a starter CSP flagged as needing testing.
   - `server_tokens off`, access to hidden files (`.git`, `.env`) and directory listings.
   - Reverse proxy: `proxy_set_header` (Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto), timeouts, buffering, WebSockets if relevant.
   - Classic mistakes with `location`, `alias` vs `root`, `try_files` and trailing slashes.
   - Limits: `client_max_body_size`, `limit_req` for login or API routes, connections.
   - Performance: compression, static caching with `expires` and `Cache-Control`, HTTP/2.
3. The full corrected file, with a short comment on each change.
4. Commands to validate and apply without downtime (`nginx -t`, reload) and `curl -I` checks to verify headers and redirects.

Constraints:
- Do not change functional behavior without telling me (routes, redirects, allowed sizes).
- If an included file is missing or you do not know the nginx version, ask me or mark the spot as [FILL IN].
- Point out what I should verify in staging before production.

How to use it

  1. Paste the output of nginx -T so every included file is covered, removing passwords or tokens first.
  2. Say what the server does and what sits behind it.
  3. Apply changes in small steps, run nginx -t, reload, and check headers with curl -I.

Usage example

Role: reverse proxy for a Node API on 127.0.0.1:3000 · Domain: api.example-store.com · Config: the current 60-line server block.

Sample output

1. Findings

SeverityBlockProblemFix
Criticallisten 80All traffic is unencrypted443 server with TLS and a 301 redirect
Highserver_namewww.example-store.com is missingAdd it to the certificate and block
Mediumlocation /No proxy_set_header: the app never sees the real IP or schemeX-Forwarded-* headers
Medium—No security headersnosniff, Referrer-Policy, HSTS
Low—server_tokens onserver_tokens off

3. Corrected file (excerpt)

server {
    listen 80;
    server_name example-store.com www.example-store.com;
    return 301 https://$host$request_uri;   # force HTTPS, keep the host
}

server {
    listen 443 ssl;
    http2 on;                                # nginx >= 1.25.1; version: [FILL IN]
    server_name example-store.com www.example-store.com;
    ssl_certificate     /etc/ssl/store/fullchain.pem;    # [FILL IN]
    ssl_certificate_key /etc/ssl/store/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    server_tokens off;

    # HSTS without includeSubDomains or preload until every subdomain is checked
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location ~ /\.(?!well-known) { deny all; }   # blocks .git, .env…

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Validate with nginx -t && systemctl reload nginx, then check that curl -I http://example-store.com returns 301…

Key facts

Category
Programming & development · DevOps
Output type
Code
Level
Intermediate
Designed for
ChatGPT, Claude, Gemini and Microsoft Copilot
Verified in
Pending editorial verification
Variables
Current configuration, Server role, Domains and Backend or root
Language
English
Price
Free, no sign-up
Updated
Nov 7, 2026

Frequently asked questions

Is it safe to enable HSTS with preload right away?

Not usually. With preload, browsers force HTTPS on the domain and its subdomains for a long time and it is hard to undo. Start with a short max-age and raise it once everything works over HTTPS.

Why is the CSP flagged as needing testing?

A strict Content-Security-Policy can block legitimate scripts, fonts or iframes. The safe path is to deploy it in Report-Only mode first and tune it before enforcing.

What is this prompt for?

Audit your nginx config and get findings ranked by severity plus a corrected, commented file: TLS, security headers, reverse proxy, rate limits, caching and redirects.

Which AI tools does it work with?

It is designed for ChatGPT, Claude, Gemini and Microsoft Copilot. We have not verified it in these tools yet, so results may vary between them.

How do I customize the prompt?

Click “Customize” and fill in the variables (Current configuration, Server role, Domains and Backend or root). The text updates instantly and you can then copy it in one click. Values are stored only in your browser.

Do I need experience to use it?

It is intermediate: it helps to know the topic so you can provide good context and review the result critically.

Is this prompt free?

Yes. Every HomeCasa Prompts prompt is free, with no sign-up or subscription. You can also use them in professional projects.

Can I trust the AI output?

Treat it as a high-quality draft: always check data, figures and important claims before publishing or making decisions.

Related prompts