nginx prevent process undefined server names

Use default_server to prevent processing requests with undefined server names

http {

  server {
    listen 80 default_server;
    listen [::]:80 default_server;
    # close connection
    return 444;

If use http to https redirect

http {
  server {
    listen 80;
    listen [::]:80;
    name_server _;

    location ^~ /.well-known/acme-challenge {
      # Install
      # letsencrypt/certbot certonly --webroot --email [email protected] --agree-tos --sta$
      default_type text/plain;
      root /etc/letsencrypt/webroot;
      try_files $uri $uri/ =404;

    location / {
      # redirect all requests to https
      return 301 https://$host$request_uri;

  server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    name_server _;
    # Enable SSL
    ssl on;
    ssl_certificate /etc/ssl/private/local.crt;
    ssl_certificate_key /etc/ssl/private/local.key;
    # close connection
    return 444;


HPKP with letsencrypt and nginx

Get SPKI-hash

Let’s Encrypt Authority X4

curl | openssl x509 -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64

Let’s Encrypt Authority X3

curl | openssl x509 -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64

ISRG Root X1

curl | openssl x509 -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64

Add config to nginx

add_header Public-Key-Pins 'pin-sha256="X4-Hash"; pin-sha256="X3-Hash"; pin-sha256="X1-Hash"; max-age=15768000;';

Reload nginx

nginx -s reload


nginx config


# Server globals
user nginx;
# Set number of worker processes automatically based on number of CPU cores.
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;
# Configures default error logger.
#error_log /var/log/nginx/error.log crit;
error_log /var/log/nginx/error.log;
pid /var/run/;
# Includes files with directives to load dynamic modules.
#load_module modules/;
# Worker config
events {
# determines how much clients will be served per worker
# max clients = worker_connections * worker_processes
# max clients is also limited by the number of socket connections available on the system (~64k)
worker_connections 4096;
# optmized to serve many clients with each thread, essential for linux
use epoll;
# accept as many connections as possible, may flood worker connections if set too low
multi_accept on;
http {
# Main settings
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=30r/m;
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
# Enable of asynchronous file I/O works on linux
aio threads;
aio_write on;
# copies data between one FD and other from within the kernel
# faster then read() + write()
sendfile on;
# send headers in one peace, its better then sending them one by one
tcp_nopush on;
# don't buffer data sent, good for small data bursts in real time
tcp_nodelay on;
# allow the server to close connection on non responding client, this will free up memory
reset_timedout_connection on;
# Nginx Simple DDoS Defense
client_header_timeout 1m;
client_body_timeout 1m;
client_header_buffer_size 2k;
client_body_buffer_size 256k;
client_max_body_size 16m;
large_client_header_buffers 4 8k;
# Just For Security Reason
server_tokens off;
server_name_in_redirect off;
server_names_hash_max_size 512;
server_names_hash_bucket_size 512;
# Log format
log_format main '$remote_addr$remote_user [$time_local] $request '
'"$status" $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format bytes '$body_bytes_sent';
# to boost I/O on HDD we can disable access logs
#access_log /var/log/nginx/access.log main;
access_log off;
# Mime settings
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Proxy settings
proxy_http_version 1.1;
proxy_cache_bypass $http_upgrade;
# Proxy headers
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
# Proxy timeouts
proxy_connect_timeout 60s;
proxy_send_timeout 90s;
proxy_read_timeout 90s;
# Restore Real IP Cloudflare
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;
# Use real IPs
real_ip_header CF-Connecting-IP;
#real_ip_header X-Forwarded-For;
# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver valid=60s;
resolver_timeout 2s;
# SSL PCI Compliance
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve X25519:prime256v1:secp384r1;
# Server Side TLS
# SSL/TLS Configuration Generator
# Oldest compatible clients
# Firefox 1, Chrome 1, IE 8 on Windows 7, Opera 5, Safari 1, Android 2.3, Java 7
# DH parameter for Perfect Forward Secrecy
# openssl dhparam -dsaparam -out /etc/ssl/dhparam.pem 4096
ssl_dhparam /etc/ssl/dhparam.pem;
# Various security headers
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "no-referrer-when-downgrade";
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
# Error pages
error_page 403 /var/www/error/403.html;
error_page 404 /var/www/error/404.html;
error_page 502 503 504 /var/www/error/500.html;
# Cache
proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=512m;
proxy_cache_key md5("$host$request_uri$cookie_user");
proxy_temp_path /var/cache/nginx/temp;
proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
proxy_cache_use_stale error timeout invalid_header updating http_502;
proxy_cache_valid any 24h;
proxy_cache_bypass $http_upgrade;
# Cache bypass
map $http_cookie $no_cache {
default 0;
~SESS 1;
~wordpress_logged_in 1;
# File cache settings
open_file_cache max=10000 inactive=30s;
open_file_cache_valid 60s;
open_file_cache_min_uses 2;
open_file_cache_errors off;
# ModSecurity
#modsecurity on;
#modsecurity_rules_file /etc/nginx/modsec/main.conf;
# Wildcard include
include /etc/nginx/conf.d/http/*.conf;
stream {
resolver valid=60s;
resolver_timeout 2s;
# Wildcard include
include /etc/nginx/conf.d/stream/*.conf;

view raw


hosted with ❤ by GitHub