Practical notes on using Nginx in real projects: web server and reverse proxy configuration, HTTPS and SSL/TLS certificates, redirects, routing, headers and production setups. I collect the problems I encounter in practice, how I diagnose them and the solutions that work.
During a traffic-spike investigation, 155 upstream errors initially looked like an availability problem in the main application. The error log showed something else: requests were reaching a separate virtual host because of HTTPS default-server behavior. That changed both the diagnosis and the protection.
After another traffic spike, I did not immediately block a country, User-Agent, or IP. I first correlated Laravel Analytics with Nginx logs, separated several independent traffic sources, verified Fail2ban behavior, and only then added Nginx rate limiting in dry-run mode.
After enabling scanner protection, I left ICanUp running overnight and reviewed the real logs in the morning. The protection worked, Fail2ban banned real addresses, and the review also exposed a DEV gap for nested sensitive paths.
After investigating automated scanning, I moved sensitive-path protection in front of Laravel. Nginx returns 403 immediately, a dedicated security log records the probe, Fail2ban reads that log, and nftables temporarily blocks the source on HTTP and HTTPS.
On September 16, 2026, ICanUp analytics showed a sharp gap between raw and deduplicated views. Nginx access logs led me to an automated scanner impersonating Googlebot while probing thousands of .env, credential, and configuration paths. This article shows the investigation commands and why scanning activity is not the same as a breach.
An HTTP header does not become trusted simply because its name starts with X-. This became important in ICanUp when Nginx started passing a GeoIP country code to Laravel. A client can send the same header itself, so the real security question is where the trust boundary lives and whether Nginx replaces client input before PHP sees it.
I needed country analytics in ICanUp without storing visitor IP addresses or calling an external GeoIP API on every page view. I moved country resolution to the Nginx and MaxMind infrastructure boundary, while Laravel receives only a normalized two-letter country code through a trusted internal header.
While renewing a Sectigo SSL certificate, DCV stayed in progress even though the verification file returned 200 OK. I traced it to a stale token and different HTTP and HTTPS validation paths in Nginx, then completed the renewal safely.