Nginx Configuration Essentials Practice Exam

Question 1 Nginx Configuration Essentials

What is `ssl_prefer_server_ciphers on;`?

Disables Nagle's algorithm (TCP_NODELAY) so small packets are sent immediately. With keepalive_timeout it enables the TCP_CORK / TCP_NODELAY trick for efficient keep-alive responses. Makes the server's cipher order win over the client's preference. Recommended for consistent hardening. HTTP Strict Transport Security tells browsers to use HTTPS only. Enable with add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; on the HTTPS server. Sets Cache-Control and Expires response headers. Example: expires 30d; for static assets. Use expires -1; to force Cache-Control: no-cache.

Question 2 Nginx Configuration Essentials

How do you deny access to hidden files (e.g. `.git`, `.env`)?

limit_req zone=one burst=20 nodelay; inside the location. burst is the queue size; nodelay serves queued requests immediately instead of spacing them. location ~ /\. { deny all; return 404; } Defines one backend. server backend1.example.com:8080 weight=3 max_fails=3 fail_timeout=30s;. weight biases load balancing; max_fails + fail_timeout mark a server as down after repeated errors. Specifies which error conditions cause nginx to retry the next upstream. Example: proxy_next_upstream error timeout http_502 http_503 http_504;. Avoid including http_404 unless intentional.

Question 3 Nginx Configuration Essentials

How do you protect a location with HTTP Basic Auth?

auth_basic "Restricted"; auth_basic_user_file /etc/nginx/.htpasswd; Generate the file with htpasswd -c /etc/nginx/.htpasswd alice. A practical starting point is worker_connections 1024; (or higher, e.g. 4096/8192) inside the events {} block. Max clients ≈ worker_processes × worker_connections. Clickjacking protection — tells browsers to disallow framing the page in an <iframe>. always ensures the header is added to error responses too. X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Content-Security-Policy, and Permissions-Policy — all set with add_header ... always;

Question 4 Nginx Configuration Essentials

How do you safely check a header with `if`?

proxy_cache my_cache; proxy_cache_valid 200 302 10m; proxy_cache_valid 404 1m; add_header X-Cache-Status $upstream_cache_status;

Defines a named group of backend servers for proxying. Example: upstream backend { server 10.0.0.1:8080; server 10.0.0.2:8080; keepalive 32; } Referenced as proxy_pass http://backend;. Routes gRPC requests to a backend, e.g. location /helloworld.Greeter/ { grpc_pass grpc://backend; }. Requires HTTP/2 (TLS or cleartext h2c) and was introduced as stable in nginx 1.13.10. Use if ($http_x_custom = "yes") { ... } — variables prefixed with $http_ are safe. Avoid $http_user_agent for routing because user agents are untrusted and frequently lie.

Question 5 Nginx Configuration Essentials

How do you enable proxy caching for a location?

log_format timed '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" rt=$request_time uct=$upstream_connect_time uht=$upstream_header_time urt=$upstream_response_time';

then reference it by name. Stores TLS session parameters to skip the handshake on resumed connections. Recommended: ssl_session_cache shared:SSL:10m; (about 40 000 sessions per 1 MB).

proxy_cache my_cache; proxy_cache_valid 200 302 10m; proxy_cache_valid 404 1m; add_header X-Cache-Status $upstream_cache_status;

Run certbot --nginx -d example.com -d www.example.com, which edits the nginx config to add the /.well-known/acme-challenge/ location, obtains the cert, and updates the HTTPS block.

Question 6 Nginx Configuration Essentials

What is `proxy_next_upstream`?

root appends the request URI to the configured path. alias replaces the matched location prefix with the alias path. With root /var/www; and request /img/x.png nginx serves /var/www/img/x.png. With alias /var/www/; for the same request it serves /var/www/img/x.png — note alias requires a trailing slash matching the location. Disables nginx's response buffering for a particular request so it streams straight to the client — useful for Server-Sent Events and long-polling. Specifies which error conditions cause nginx to retry the next upstream. Example: proxy_next_upstream error timeout http_502 http_503 http_504;. Avoid including http_404 unless intentional. Time allowed between two successive read operations from the upstream while a response is being received. Default 60s. Increase for slow long-poll/SSE endpoints.

Question 7 Nginx Configuration Essentials

What does `add_header` do?

nginx -t (or nginx -T to additionally dump the parsed configuration to stdout). Useful in CI/CD pipelines before a reload. Adds an arbitrary response header, e.g. add_header X-Frame-Options "SAMEORIGIN";. Always add always when the response code is an error: add_header ... always;

proxy_cache my_cache; proxy_cache_valid 200 302 10m; proxy_cache_valid 404 1m; add_header X-Cache-Status $upstream_cache_status;

location ~ \.php$ { fastcgi_pass unix:/run/php/php8.2-fpm.sock; fastcgi_index index.php; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; }

Question 8 Nginx Configuration Essentials

What is `proxy_connect_timeout`?

Time allowed to establish a TCP connection to the upstream. Default is 60s. Example: proxy_connect_timeout 5s; server 10.0.0.5:8080 down; — nginx skips it entirely without removing the entry. A response header from upstream that tells nginx to serve an internal file and finish the request. Example: X-Accel-Redirect: /protected/file.pdf maps to an internal location for access-controlled downloads. last stops the current server/location processing and starts a fresh match against the rewritten URI. break stops rewrite processing in the current location and continues with the rewritten URI in the same location.

Question 9 Nginx Configuration Essentials

How do you issue a Let's Encrypt certificate with the HTTP-01 challenge?

Defines a named group of backend servers for proxying. Example: upstream backend { server 10.0.0.1:8080; server 10.0.0.2:8080; keepalive 32; } Referenced as proxy_pass http://backend;. Run certbot --nginx -d example.com -d www.example.com, which edits the nginx config to add the /.well-known/acme-challenge/ location, obtains the cert, and updates the HTTPS block. A single master process that reads configuration, manages sockets, and spawns worker processes (default count = CPU cores). Workers handle all incoming connections using an event-driven, non-blocking loop. Rewrites the request URI using a regex, optionally capturing groups. Example: rewrite ^/old/(.*)$ /new/$1 permanent;. The last flag (last, break, redirect, permanent) controls whether further rewrite/location processing happens.

Question 10 Nginx Configuration Essentials

How do you support keep-alive connections to upstream backends?

if creates a conditional branch. The official wiki warns: if is evil when used outside location or when checking request headers — prefer map, try_files, or a dedicated location block. Add keepalive 32; inside the upstream block and use proxy_http_version 1.1; proxy_set_header Connection ""; in the location to enable HTTP/1.1 keep-alive to the upstream pool. proxy_no_cache decides whether to save the response to cache at all. proxy_cache_bypass decides whether to serve the request from cache (if available) or fetch fresh — they are often used together for the same condition. A response header from upstream that tells nginx to serve an internal file and finish the request. Example: X-Accel-Redirect: /protected/file.pdf maps to an internal location for access-controlled downloads.

Question 11 Nginx Configuration Essentials

What is the `server_name` directive used for?

Disables health checking for that server — it is always considered available, even after errors. Use only for backends with their own reliability guarantees. Time allowed to establish a TCP connection to the upstream. Default is 60s. Example: proxy_connect_timeout 5s; Time allowed for transmitting a request to the upstream. Default 60s. Defines virtual host names that a server block responds to. Supports exact names, leading wildcards (*.example.com), trailing wildcards (www.example.*), and regexes prefixed with ~.

Question 12 Nginx Configuration Essentials

Order the location matching types from highest to lowest priority.

Caches file descriptors and metadata for frequently written log files to reduce syscall overhead. Example: open_log_file_cache max=1000 inactive=20s valid=1m min_uses=2; 1. = exact match → 2. ^~ preferential prefix → 3. ~/~* regex (first defined wins) → 4. longest matching prefix. Defines virtual host names that a server block responds to. Supports exact names, leading wildcards (*.example.com), trailing wildcards (www.example.*), and regexes prefixed with ~. server 10.0.0.5:8080 down; — nginx skips it entirely without removing the entry.

Question 13 Nginx Configuration Essentials

How do you configure nginx for websockets?

proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 86400;

— these four lines forward the WebSocket handshake and keep the connection open. 75s. Lower it (e.g. keepalive_timeout 30;) for high-volume servers to free worker sockets sooner. auth_basic "Restricted"; auth_basic_user_file /etc/nginx/.htpasswd; Generate the file with htpasswd -c /etc/nginx/.htpasswd alice. Marks the site for inclusion in browsers' built-in HSTS preload list. Requires a submission to hstspreload.org and is hard to undo — browsers bake the policy in for months.

Question 14 Nginx Configuration Essentials

What does `proxy_pass http://backend` do (without a trailing slash)?

Builds a new variable by matching input against patterns, evaluated once per request. map $http_accept_language $lang { default en; ~^fr fr; } in the http context. Forwards the full original URI to the upstream, including the matched location prefix. E.g. location /api/ with proxy_pass http://backend forwards /api/users as /api/users. Run certbot --nginx -d example.com -d www.example.com, which edits the nginx config to add the /.well-known/acme-challenge/ location, obtains the cert, and updates the HTTPS block. X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Content-Security-Policy, and Permissions-Policy — all set with add_header ... always;

Question 15 Nginx Configuration Essentials

What does `client_body_buffer_size` control?

Hashes the client's IP to pick a backend so the same client always reaches the same server. Limitation: it cannot tell clients behind a shared NAT or proxy apart, and it breaks when a backend is added or removed (most clients remap). When enabled with sendfile, it instructs nginx to send response headers in one TCP packet (uses TCP_CORK). It is set with tcp_nopush on;. The buffer size for reading the request body. Requests exceeding it spill to a temporary file (client_body_temp_path). Default is 8k; common values are 16k/32k. stop sends SIGTERM to workers and forces them to exit immediately, closing open connections. quit sends SIGQUIT, which lets workers finish serving current requests before exiting.

Question 16 Nginx Configuration Essentials

What is the purpose of `proxy_set_header Connection "";`?

location / { root /var/www/app/dist; try_files $uri $uri/ /index.html; } location ~* \.(?:js|css|woff2?|png|jpg|svg)$ { expires 1y; add_header Cache-Control "public, immutable"; }

Time allowed between two successive read operations from the upstream while a response is being received. Default 60s. Increase for slow long-poll/SSE endpoints. Clears the Connection header sent to the upstream. Required when activating upstream keep-alive so the upstream does not see Connection: close. Runtime errors and warnings. Default level is error. Increase verbosity with error_log /var/log/nginx/error.log info; or debug (which requires error_log ... debug; plus a debug build).

Question 17 Nginx Configuration Essentials

How do you enable gzip compression for a response that is not on the default MIME list?

Add the MIME type to gzip_types, e.g. gzip_types application/graphql+json application/xml; 1. = exact match → 2. ^~ preferential prefix → 3. ~/~* regex (first defined wins) → 4. longest matching prefix. if creates a conditional branch. The official wiki warns: if is evil when used outside location or when checking request headers — prefer map, try_files, or a dedicated location block. Creates a variable whose value depends on the client IP, loaded from a CIDR list. Used for geolocation, allow/deny lists, and routing: geo $country { default ZZ; 10.0.0.0/8 US; }

Question 18 Nginx Configuration Essentials

What does `tcp_nopush` do?

nginx -t (or nginx -T to additionally dump the parsed configuration to stdout). Useful in CI/CD pipelines before a reload. Allows the upstream connection to stay idle for 24 hours instead of timing out at 60 s, so long-lived socket sessions are not dropped. When enabled with sendfile, it instructs nginx to send response headers in one TCP packet (uses TCP_CORK). It is set with tcp_nopush on;. Round-robin (default), least_conn, ip_hash, and random (with optional two method). Sticky sessions via ip_hash (or the newer sticky cookie|route|learn directive in nginx Plus).

Question 19 Nginx Configuration Essentials

How do you serve a directory listing?

A location starting with @ is only reachable via an internal redirect (e.g. try_files / @fallback; or error_page 404 @fallback;). It is used for request-handling logic independent of any URI. When enabled with sendfile, it instructs nginx to send response headers in one TCP packet (uses TCP_CORK). It is set with tcp_nopush on;. Add autoindex on; inside the location (and ensure no index file exists). autoindex_exact_size off; shows sizes in KB/MB; autoindex_format html; is the default output style. Stops browsers from MIME-sniffing a response away from the declared Content-Type, mitigating some XSS / content-confusion attacks.

Question 20 Nginx Configuration Essentials

What is the `map` directive?

Builds a new variable by matching input against patterns, evaluated once per request. map $http_accept_language $lang { default en; ~^fr fr; } in the http context. upstream_cache_status — HIT, MISS, BYPASS, EXPIRED, STALE, UPDATING, or REVALIDATED — for debugging cache behavior. Hashes the client's IP to pick a backend so the same client always reaches the same server. Limitation: it cannot tell clients behind a shared NAT or proxy apart, and it breaks when a backend is added or removed (most clients remap). gzip_static on; nginx serves the pre-compressed version of file.js when file.js.gz exists, saving CPU at request time.

Question 21 Nginx Configuration Essentials

What does `fastcgi_cache_path` do?

Time allowed for transmitting a request to the upstream. Default 60s. Checks files in order and serves the first that exists. Example: try_files $uri $uri/ /index.php?$query_string; — the last argument is a fallback URI or named location used when none exist. Same as proxy_cache_path but for FastCGI (typically PHP-FPM) responses. Pair with fastcgi_cache, fastcgi_cache_valid, and fastcgi_cache_key "$scheme$request_method$host$request_uri". location ~* \.html$ { add_header Cache-Control "no-store, no-cache, must-revalidate"; expires off; }

Question 22 Nginx Configuration Essentials

Where is nginx's main configuration file by default on Linux?

Time spent receiving the response from the upstream, in seconds, with millisecond precision. Multiple values (comma-separated) are recorded when retries occur. Clickjacking protection — tells browsers to disallow framing the page in an <iframe>. always ensures the header is added to error responses too. /etc/nginx/nginx.conf. Additional files are typically included via include /etc/nginx/conf.d/*.conf; and per-site configs in /etc/nginx/sites-enabled/. Time allowed to establish a TCP connection to the upstream. Default is 60s. Example: proxy_connect_timeout 5s;

Question 23 Nginx Configuration Essentials

What is the purpose of `ssl_session_cache`?

75s. Lower it (e.g. keepalive_timeout 30;) for high-volume servers to free worker sockets sooner. Same as proxy_cache_path but for FastCGI (typically PHP-FPM) responses. Pair with fastcgi_cache, fastcgi_cache_valid, and fastcgi_cache_key "$scheme$request_method$host$request_uri". Stores TLS session parameters to skip the handshake on resumed connections. Recommended: ssl_session_cache shared:SSL:10m; (about 40 000 sessions per 1 MB). Adds an arbitrary response header, e.g. add_header X-Frame-Options "SAMEORIGIN";. Always add always when the response code is an error: add_header ... always;

Question 24 Nginx Configuration Essentials

How do you set far-future caching for fingerprinted assets?

proxy_cache my_cache; proxy_cache_valid 200 302 10m; proxy_cache_valid 404 1m; add_header X-Cache-Status $upstream_cache_status;

limit_req zone=one burst=20 nodelay; inside the location. burst is the queue size; nodelay serves queued requests immediately instead of spacing them. location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ { expires 1y; add_header Cache-Control "public, immutable"; } proxy_pass forwards HTTP to another HTTP server. fastcgi_pass speaks the FastCGI protocol to PHP-FPM and similar apps, requiring fastcgi_param mappings instead of proxy_set_header.

Question 25 Nginx Configuration Essentials

How do you rate-limit login attempts to a specific URL?

server 10.0.0.5:8080 down; — nginx skips it entirely without removing the entry. The number of worker processes the master spawns. The conventional setting is worker_processes auto;, which detects the number of CPU cores. It removes response headers set by upstream. It is not built into nginx OSS — it comes from the headers-more module. Equivalent built-in trick: set the header to an empty string: proxy_hide_header X-Powered-By; Combine limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m; with location = /login { limit_req zone=login burst=10 nodelay; ... }

Question 26 Nginx Configuration Essentials

What is the `grpc_pass` directive?

Forwards the full original URI to the upstream, including the matched location prefix. E.g. location /api/ with proxy_pass http://backend forwards /api/users as /api/users. It removes response headers set by upstream. It is not built into nginx OSS — it comes from the headers-more module. Equivalent built-in trick: set the header to an empty string: proxy_hide_header X-Powered-By; Clears the Connection header sent to the upstream. Required when activating upstream keep-alive so the upstream does not see Connection: close. Routes gRPC requests to a backend, e.g. location /helloworld.Greeter/ { grpc_pass grpc://backend; }. Requires HTTP/2 (TLS or cleartext h2c) and was introduced as stable in nginx 1.13.10.

Question 27 Nginx Configuration Essentials

What is the `geo` directive?

stop sends SIGTERM to workers and forces them to exit immediately, closing open connections. quit sends SIGQUIT, which lets workers finish serving current requests before exiting. server 10.0.0.5:8080 down; — nginx skips it entirely without removing the entry. HTTP Strict Transport Security tells browsers to use HTTPS only. Enable with add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; on the HTTPS server. Creates a variable whose value depends on the client IP, loaded from a CIDR list. Used for geolocation, allow/deny lists, and routing: geo $country { default ZZ; 10.0.0.0/8 US; }

Question 28 Nginx Configuration Essentials

What is HSTS and how do you enable it?

HTTP Strict Transport Security tells browsers to use HTTPS only. Enable with add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; on the HTTPS server. if creates a conditional branch. The official wiki warns: if is evil when used outside location or when checking request headers — prefer map, try_files, or a dedicated location block. Tells nginx to fetch OCSP responses from the CA and staple them into the TLS handshake. Enable with ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 1.1.1.1 valid=300s; certbot renew --quiet --deploy-hook "systemctl reload nginx" in a daily cron. Certificates expire every 90 days.

Question 29 Nginx Configuration Essentials

What command tests configuration syntax without applying it?

Forwards the full original URI to the upstream, including the matched location prefix. E.g. location /api/ with proxy_pass http://backend forwards /api/users as /api/users. nginx -t (or nginx -T to additionally dump the parsed configuration to stdout). Useful in CI/CD pipelines before a reload. Stores TLS session parameters to skip the handshake on resumed connections. Recommended: ssl_session_cache shared:SSL:10m; (about 40 000 sessions per 1 MB). Tells nginx to fetch OCSP responses from the CA and staple them into the TLS handshake. Enable with ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 1.1.1.1 valid=300s;

Question 30 Nginx Configuration Essentials

What are the minimum directives to enable TLS on a server block?

Caches file descriptors and metadata for frequently written log files to reduce syscall overhead. Example: open_log_file_cache max=1000 inactive=20s valid=1m min_uses=2;

listen 443 ssl; ssl_certificate /etc/ssl/certs/example.com.pem; ssl_certificate_key /etc/ssl/private/example.com.key; ssl_protocols TLSv1.2 TLSv1.3;

Requires the nginx-module-brotli (or built-in via Cloudflare/QuicTLS forks). Then brotli on; brotli_types text/plain text/css application/javascript application/json; brotli_comp_level 6; SSLv2, SSLv3, TLSv1.0, and TLSv1.1 are all deprecated. Use ssl_protocols TLSv1.2 TLSv1.3;

Question 31 Nginx Configuration Essentials

How do you hide the nginx version in error pages and `Server` headers?

When enabled, nginx buffers the entire upstream response to disk before forwarding to the client (great for slow clients, frees up upstream quickly). When off, responses stream straight through with minimum buffering. Use server_tokens off;. It strips the version from error pages and from the Server response header. Add the MIME type to gzip_types, e.g. gzip_types application/graphql+json application/xml; Sends an immediate HTTP response without contacting upstream. Example: return 301 https://example.com$request_uri; for a redirect, or return 404; to abort with Not Found.

Question 32 Nginx Configuration Essentials

What is the canonical "Nginx + Vue/React history fallback" snippet?

ACL directives for client access control. allow permits; deny rejects with 403. Example: allow 10.0.0.0/8; deny all; http {} (HTTP server settings) and server {} (virtual host). Inside them live location {}, upstream {}, events {}, and the top-level main context.

location / { root /var/www/app/dist; try_files $uri $uri/ /index.html; } location ~* \.(?:js|css|woff2?|png|jpg|svg)$ { expires 1y; add_header Cache-Control "public, immutable"; }

Runtime errors and warnings. Default level is error. Increase verbosity with error_log /var/log/nginx/error.log info; or debug (which requires error_log ... debug; plus a debug build).

Question 33 Nginx Configuration Essentials

What is the `server` directive inside `upstream`?

Defines one backend. server backend1.example.com:8080 weight=3 max_fails=3 fail_timeout=30s;. weight biases load balancing; max_fails + fail_timeout mark a server as down after repeated errors. stop sends SIGTERM to workers and forces them to exit immediately, closing open connections. quit sends SIGQUIT, which lets workers finish serving current requests before exiting. last stops the current server/location processing and starts a fresh match against the rewritten URI. break stops rewrite processing in the current location and continues with the rewritten URI in the same location. Disables Nagle's algorithm (TCP_NODELAY) so small packets are sent immediately. With keepalive_timeout it enables the TCP_CORK / TCP_NODELAY trick for efficient keep-alive responses.

Question 34 Nginx Configuration Essentials

What is the `uwsgi_pass` directive used for?

Routes gRPC requests to a backend, e.g. location /helloworld.Greeter/ { grpc_pass grpc://backend; }. Requires HTTP/2 (TLS or cleartext h2c) and was introduced as stable in nginx 1.13.10. Proxies to a uWSGI application server (commonly Python WSGI apps) using the uwsgi protocol on a TCP port or Unix socket. Time allowed to establish a TCP connection to the upstream. Default is 60s. Example: proxy_connect_timeout 5s; Checks files in order and serves the first that exists. Example: try_files $uri $uri/ /index.php?$query_string; — the last argument is a fallback URI or named location used when none exist.

Question 35 Nginx Configuration Essentials

What does `$request_time` measure?

root appends the request URI to the configured path. alias replaces the matched location prefix with the alias path. With root /var/www; and request /img/x.png nginx serves /var/www/img/x.png. With alias /var/www/; for the same request it serves /var/www/img/x.png — note alias requires a trailing slash matching the location. certbot renew --quiet --deploy-hook "systemctl reload nginx" in a daily cron. Certificates expire every 90 days. /etc/nginx/nginx.conf. Additional files are typically included via include /etc/nginx/conf.d/*.conf; and per-site configs in /etc/nginx/sites-enabled/. Total time spent processing the request in seconds, from the first byte received from the client to the last byte sent back. Useful for end-to-end latency reporting.

Question 36 Nginx Configuration Essentials

How do you apply a rate limit to a location?

Use server_tokens off;. It strips the version from error pages and from the Server response header. A practical starting point is worker_connections 1024; (or higher, e.g. 4096/8192) inside the events {} block. Max clients ≈ worker_processes × worker_connections. A single master process that reads configuration, manages sockets, and spawns worker processes (default count = CPU cores). Workers handle all incoming connections using an event-driven, non-blocking loop. limit_req zone=one burst=20 nodelay; inside the location. burst is the queue size; nodelay serves queued requests immediately instead of spacing them.

Question 37 Nginx Configuration Essentials

What is `proxy_read_timeout`?

Disables health checking for that server — it is always considered available, even after errors. Use only for backends with their own reliability guarantees. Time allowed between two successive read operations from the upstream while a response is being received. Default 60s. Increase for slow long-poll/SSE endpoints. proxy_hide_header X-Powered-By; inside the relevant location or server. ACL directives for client access control. allow permits; deny rejects with 403. Example: allow 10.0.0.0/8; deny all;

Question 38 Nginx Configuration Essentials

What is the standard Let's Encrypt renewal hook for nginx?

It removes response headers set by upstream. It is not built into nginx OSS — it comes from the headers-more module. Equivalent built-in trick: set the header to an empty string: proxy_hide_header X-Powered-By; certbot renew --quiet --deploy-hook "systemctl reload nginx" in a daily cron. Certificates expire every 90 days. Add internal; inside the location block. Requests from clients return 404; only internal redirects (X-Accel-Redirect, error_page, rewrite ... last) can reach it. proxy_pass forwards HTTP to another HTTP server. fastcgi_pass speaks the FastCGI protocol to PHP-FPM and similar apps, requiring fastcgi_param mappings instead of proxy_set_header.

Question 39 Nginx Configuration Essentials

What is `proxy_cache_path`?

75s. Lower it (e.g. keepalive_timeout 30;) for high-volume servers to free worker sockets sooner.

ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;

with ssl_prefer_server_ciphers on; Defines one backend. server backend1.example.com:8080 weight=3 max_fails=3 fail_timeout=30s;. weight biases load balancing; max_fails + fail_timeout mark a server as down after repeated errors. Defines a disk-based cache zone for proxy responses. Example: proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=60m use_temp_path=off;

Question 40 Nginx Configuration Essentials

What is nginx's primary process model?

Caches file descriptors and metadata for frequently written log files to reduce syscall overhead. Example: open_log_file_cache max=1000 inactive=20s valid=1m min_uses=2; A single master process that reads configuration, manages sockets, and spawns worker processes (default count = CPU cores). Workers handle all incoming connections using an event-driven, non-blocking loop. Disables nginx's response buffering for a particular request so it streams straight to the client — useful for Server-Sent Events and long-polling. Sets the document root for all locations in that server. Equivalent to placing root in each location. location-level root or alias overrides it.

Question 41 Nginx Configuration Essentials

What is `gzip on;` used for?

Time allowed between two successive read operations from the upstream while a response is being received. Default 60s. Increase for slow long-poll/SSE endpoints. stop sends SIGTERM to workers and forces them to exit immediately, closing open connections. quit sends SIGQUIT, which lets workers finish serving current requests before exiting. Enables on-the-fly gzip compression of HTTP responses. Pair with gzip_types text/plain text/css application/json application/javascript text/xml; and gzip_min_length 256; to avoid compressing tiny responses. Requires the nginx-module-brotli (or built-in via Cloudflare/QuicTLS forks). Then brotli on; brotli_types text/plain text/css application/javascript application/json; brotli_comp_level 6;

Question 42 Nginx Configuration Essentials

What does the `worker_processes` directive control?

Stops browsers from MIME-sniffing a response away from the declared Content-Type, mitigating some XSS / content-confusion attacks. The number of worker processes the master spawns. The conventional setting is worker_processes auto;, which detects the number of CPU cores. Disables health checking for that server — it is always considered available, even after errors. Use only for backends with their own reliability guarantees. Disables Nagle's algorithm (TCP_NODELAY) so small packets are sent immediately. With keepalive_timeout it enables the TCP_CORK / TCP_NODELAY trick for efficient keep-alive responses.

Question 43 Nginx Configuration Essentials

What does the `rewrite` directive do?

location ~* \.html$ { add_header Cache-Control "no-store, no-cache, must-revalidate"; expires off; } Rewrites the request URI using a regex, optionally capturing groups. Example: rewrite ^/old/(.*)$ /new/$1 permanent;. The last flag (last, break, redirect, permanent) controls whether further rewrite/location processing happens.

listen 443 ssl; ssl_certificate /etc/ssl/certs/example.com.pem; ssl_certificate_key /etc/ssl/private/example.com.key; ssl_protocols TLSv1.2 TLSv1.3;

The buffer size for reading the request body. Requests exceeding it spill to a temporary file (client_body_temp_path). Default is 8k; common values are 16k/32k.

Question 44 Nginx Configuration Essentials

How do you bypass the cache for a specific cookie or request?

HTTP Strict Transport Security tells browsers to use HTTPS only. Enable with add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; on the HTTPS server. proxy_cache_bypass $cookie_nocache $arg_nocache; proxy_no_cache $cookie_nocache $arg_nocache; This causes authenticated or tagged requests to skip the cache. server 10.0.0.5:8080 down; — nginx skips it entirely without removing the entry. A location starting with @ is only reachable via an internal redirect (e.g. try_files / @fallback; or error_page 404 @fallback;). It is used for request-handling logic independent of any URI.

Question 45 Nginx Configuration Essentials

What is the meaning of the `combined` log format?

Sends the original Host header (or the server name) to the upstream. Without it, upstreams receive Host: backend (the upstream name), which can break virtual-hosted apps. Runtime errors and warnings. Default level is error. Increase verbosity with error_log /var/log/nginx/error.log info; or debug (which requires error_log ... debug; plus a debug build). The default access log format: $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" fastcgi_cache_key "$scheme$request_method$host$request_uri" — optionally add $cookie_logged_in so authenticated users bypass the cache.

Question 46 Nginx Configuration Essentials

What is `resolver` used for?

Names the DNS server(s) nginx uses to resolve upstream hostnames (e.g. resolver 1.1.1.1 8.8.8.8 valid=300s;). Required for variables like proxy_pass http://my.service.consul:$server_port;. proxy_cache_bypass $cookie_nocache $arg_nocache; proxy_no_cache $cookie_nocache $arg_nocache; This causes authenticated or tagged requests to skip the cache. Runtime errors and warnings. Default level is error. Increase verbosity with error_log /var/log/nginx/error.log info; or debug (which requires error_log ... debug; plus a debug build). include /path/to/file.conf; Glob patterns are supported, e.g. include /etc/nginx/conf.d/*.conf;.

Question 47 Nginx Configuration Essentials

What does `proxy_pass http://backend/` do (with a trailing slash)?

Replaces the matched location prefix with /. E.g. location /api/ with proxy_pass http://backend/ forwards /api/users as /users. When enabled with sendfile, it instructs nginx to send response headers in one TCP packet (uses TCP_CORK). It is set with tcp_nopush on;. A practical starting point is worker_connections 1024; (or higher, e.g. 4096/8192) inside the events {} block. Max clients ≈ worker_processes × worker_connections. fastcgi_cache_key "$scheme$request_method$host$request_uri" — optionally add $cookie_logged_in so authenticated users bypass the cache.

Question 48 Nginx Configuration Essentials

What is `X-Accel-Redirect`?

location ~ /\. { deny all; return 404; } proxy_no_cache decides whether to save the response to cache at all. proxy_cache_bypass decides whether to serve the request from cache (if available) or fetch fresh — they are often used together for the same condition. Add keepalive 32; inside the upstream block and use proxy_http_version 1.1; proxy_set_header Connection ""; in the location to enable HTTP/1.1 keep-alive to the upstream pool. A response header from upstream that tells nginx to serve an internal file and finish the request. Example: X-Accel-Redirect: /protected/file.pdf maps to an internal location for access-controlled downloads.

Question 49 Nginx Configuration Essentials

What is `preload` in the HSTS header?

http {} (HTTP server settings) and server {} (virtual host). Inside them live location {}, upstream {}, events {}, and the top-level main context. Enables on-the-fly gzip compression of HTTP responses. Pair with gzip_types text/plain text/css application/json application/javascript text/xml; and gzip_min_length 256; to avoid compressing tiny responses. Replaces the matched location prefix with /. E.g. location /api/ with proxy_pass http://backend/ forwards /api/users as /users. Marks the site for inclusion in browsers' built-in HSTS preload list. Requires a submission to hstspreload.org and is hard to undo — browsers bake the policy in for months.

Question 50 Nginx Configuration Essentials

Which TLS protocols should you disable?

certbot renew --quiet --deploy-hook "systemctl reload nginx" in a daily cron. Certificates expire every 90 days.

proxy_cache my_cache; proxy_cache_valid 200 302 10m; proxy_cache_valid 404 1m; add_header X-Cache-Status $upstream_cache_status;

SSLv2, SSLv3, TLSv1.0, and TLSv1.1 are all deprecated. Use ssl_protocols TLSv1.2 TLSv1.3; Allows the upstream connection to stay idle for 24 hours instead of timing out at 60 s, so long-lived socket sessions are not dropped.

What is ssl_prefer_server_ciphers on;?

How do you deny access to hidden files (e.g. .git, .env)?

How do you protect a location with HTTP Basic Auth?

How do you safely check a header with if?

How do you enable proxy caching for a location?

What is proxy_next_upstream?

What does add_header do?

What is proxy_connect_timeout?

How do you issue a Let's Encrypt certificate with the HTTP-01 challenge?

How do you support keep-alive connections to upstream backends?

What is the server_name directive used for?

Order the location matching types from highest to lowest priority.

How do you configure nginx for websockets?

What does proxy_pass http://backend do (without a trailing slash)?

What does client_body_buffer_size control?

What is the purpose of proxy_set_header Connection "";?

How do you enable gzip compression for a response that is not on the default MIME list?

What does tcp_nopush do?

How do you serve a directory listing?

What is the map directive?

What does fastcgi_cache_path do?