Nginx and Caddy config generators

Pick a generator, fill in a few fields and get a hardened Nginx and Caddy config with a security score. Nothing leaves your browser.

Generators

• Reverse proxy — Proxy traffic to a backend app with optional rate limiting, WebSocket support and TLS.
• fail2ban jail — Generate a fail2ban filter and jail that bans scanners probing for .env, .git, wp-login and similar — for a JSON or combined nginx log.
• Bot & scanner blocking — Deny common scanner probes (.env, .git, wp-login, credential files…) at the web server, before they reach your app.
• Static site — Serve a static site or SPA with caching, security headers, and hidden file protection.
• PHP-FPM — Run a PHP app via FastCGI with WordPress, Laravel, Symfony, and Drupal presets.
• Load balancer — Distribute traffic across an upstream pool with health checks, sticky sessions, and keepalive.
• nginx.conf — Generate a complete global nginx.conf with worker tuning, gzip, SSL session cache, and rate limiting zones.
• Content-Security-Policy — Build a CSP directive by directive, scored against unsafe-inline, unsafe-eval, and a missing frame-ancestors.
• CORS headers — Configure Access-Control-Allow-* headers for Nginx or Caddy: specific origins, preflight handling and credential scoping.
• Security headers — HSTS, nosniff, frame and referrer policy, Permissions-Policy and cross-origin isolation headers for Nginx, Caddy or Apache.
• TLS / SSL — Mozilla-style modern, intermediate or old TLS profiles for Nginx and Caddy, with HTTP→HTTPS redirect, session settings and a certbot script.
• Rate limiting — Nginx limit_req and limit_conn zones per client IP, with burst, 429 status, a dry-run mode and an allow-list for trusted addresses.
• Caching & compression — Gzip or brotli compression and Cache-Control headers for Nginx and Caddy: immutable fingerprinted assets, revalidated HTML, cached media.
• Redirect map — Turn a list of old → new URLs into exact-match 301/302/307/308 redirects for Nginx, Caddy and Apache, with loop and chain detection.
• robots.txt, sitemap & security.txt — Generate robots.txt, sitemap.xml and an RFC 9116 security.txt for a site: crawl rules, an optional AI-crawler opt-out, and a vulnerability-contact file.
• Apache .htaccess — A hardened .htaccess for shared hosting and Apache: HTTPS and www redirects, security headers, compression, caching and blocked dotfiles and backups.
• Docker & Compose — A Dockerfile, docker-compose.yml and .dockerignore for Node, Python or a static site: pinned images, non-root user, healthcheck and hardened containers.
• systemd service & timer — A hardened systemd service unit, with an optional timer: dedicated user, sandboxing directives, restart policy and a state directory.
• Cron expression — Explain a cron expression in plain English, preview its next run times, and get the equivalent systemd OnCalendar value.
• SSH hardening — A drop-in sshd_config that disables root login and password logins, limits tries and forwarding, with a script that applies it without locking you out.
• Firewall rules — Default-deny inbound rules for ufw, nftables and iptables from a list of ports: SSH is always allowed first, so applying it cannot lock you out.
• Glob pattern tester — Test glob patterns (*, **, ?, [abc], {a,b}) against a list of paths, see which match and why, and get the equivalent regular expression.
• Access log filter — Build awk commands for nginx and Apache access logs: filter by status, method, IP, date or text, and rank the top IPs, paths and status codes.
• Regex tester — Test a pattern against sample text, get a plain-English breakdown, and check it compiles for nginx, Caddy and fail2ban.
• CI/CD snippets — Generate GitHub Actions and GitLab CI YAML to test and deploy your nginx or Caddy configs in a pipeline.
• Home network IP plan — A quick, standard IPv4 plan for a home network: which addresses each network uses, what DHCP hands out, and what to type into your router, with dnsmasq and ISC files if you run your own.
• Subnet calculator — Netmask, wildcard, broadcast, host range and usable hosts for any IPv4 or IPv6 network, with an equal split or a variable-length (VLSM) plan from host counts.
• VLAN & interfaces — VLAN-tagged interfaces, optional bond and per-VLAN bridges, as netplan, systemd-networkd, ifupdown and a one-shot iproute2 script.
• Static routes & policy routing — Static routes, blackholes and policy-routing rules with their own tables, as an iproute2 script, netplan, systemd-networkd and ifupdown.
• NAT & port forwarding — Masquerade a LAN behind one WAN address and forward chosen ports to LAN hosts, as nftables and iptables rules, with the sysctl that turns routing on.
• DHCP server — A DHCP scope for dnsmasq and ISC dhcpd: address pool, router, DNS servers, lease time and fixed addresses for known MAC addresses.
• DNS zone (BIND) — A BIND zone file with SOA, name servers and A, AAAA, CNAME, MX, TXT, SRV and CAA records, an optional reverse zone with PTRs, and the named.conf entry.
• WireGuard VPN — A WireGuard server and one config per client, with a setup script that generates the keys on your machine so no secret is ever created or shown here.

Guides

• Nginx Reverse Proxy Configuration
• Caddy Reverse Proxy Configuration
• Nginx Static Site Configuration
• Caddy Static Site Configuration
• Nginx + PHP-FPM Configuration
• Caddy + PHP-FPM Configuration
• Nginx SSL/TLS Configuration
• Nginx Load Balancer Configuration
• Caddy Load Balancer Configuration
• Nginx Rate Limiting Configuration
• Nginx Security Headers Configuration
• Caddy Security Headers Configuration
• Nginx Gzip Compression Configuration
• Nginx Caching Configuration
• Caddy HTTPS Redirect Configuration
• Nginx WebSocket Proxy Configuration
• Nginx Content-Security-Policy Header
• Block Bad Bots and Scanners in Nginx
• fail2ban for Nginx
• nginx.conf Best Practices
• Nginx Location Regex Tester
• Deploy Nginx Config with GitHub Actions
• Nginx CORS Headers Configuration
• Nginx Cache-Control Headers Configuration
• Nginx 301 Redirect Map Configuration
• robots.txt, Sitemap and security.txt
• Apache .htaccess Configuration
• Docker Compose and Dockerfile Configuration
• systemd Service and Timer Configuration
• Cron Expression Explainer
• SSH Hardening with sshd_config
• Linux Firewall Rules: ufw, nftables and iptables
• Glob Pattern Tester
• Analysing Nginx Access Logs with awk
• Subnet Mask and CIDR Calculator
• VLAN Configuration on Linux
• Static Routes and Policy Routing on Linux
• NAT and Port Forwarding with nftables
• DHCP Server Configuration
• BIND Zone File Example
• WireGuard Server and Client Configuration
• A Simple IP Plan for Your Home Network