Use nginx or Caddy as the web server and reverse proxy

Cost

Open source. nginx is BSD-2-Clause and Caddy is Apache-2.0. A commercial nginx edition is paid.

How to do it

nginx has been in production since 2004 and is under the BSD-2-Clause licence. The stable branch 1.30 started on 14 April 2026, and 1.30.6 shipped on 14 October 2026. Its official Docker image has over 13 billion pulls. Caddy 2 has been stable since 2020 and is under Apache-2.0. Version 2.11.7 shipped on 3 October 2026. Caddy gets and renews TLS certificates by itself with no extra tool. AI tools write both config formats well. Use nginx when you need its large module set or already run it. Choose something else when your cloud's load balancer already ends TLS. Then the app server sits behind it directly. Set the security headers, starting with Allow only the scripts you wrote.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

nginx example

server {
    listen 443 ssl;
    http2 on;
    server_name example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    add_header Strict-Transport-Security "max-age=31536000" always;
    location / { proxy_pass http://127.0.0.1:8080; }
}

Plain text example

example.com {
    reverse_proxy 127.0.0.1:8080
    header Strict-Transport-Security "max-age=31536000"
}

How to check

nginx -v or caddy version prints a release from the last six months. curl -sI https://example.com returns a strict-transport-security header.

Sources

• nginx
• Caddy reverse proxy

Related rules

• Allow only the scripts you wrote in Website