How to Install and Secure Nginx with HTTPS

Install from the Ubuntu repository and confirm the service is running.

sudo apt update
sudo apt install -y nginx
sudo systemctl enable --now nginx   # start now and on every boot
systemctl status nginx --no-pager   # verify it is active (running)

Allow HTTP and HTTPS through UFW. Make sure SSH is already allowed first.

sudo ufw allow 'Nginx Full'   # opens both 80 (HTTP) and 443 (HTTPS)
sudo ufw status

Define a virtual host for your site, then enable it by symlinking into sites-enabled.

sudo nano /etc/nginx/sites-available/yourdomain.com   # add your server { ... } block with server_name and root
sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/

By default Nginx advertises its exact version in responses and error pages, which helps attackers. Turn that off.

sudo nano /etc/nginx/nginx.conf
# Inside the http { } block, uncomment or add:
server_tokens off;   # stop leaking the Nginx version number

These headers reduce clickjacking, MIME-sniffing, and referrer leakage. Add them inside your site's server block.

# Inside your server { } block in /etc/nginx/sites-available/yourdomain.com :
add_header X-Content-Type-Options "nosniff" always;        # stop MIME-type sniffing
add_header X-Frame-Options "SAMEORIGIN" always;            # block clickjacking via frames
add_header Referrer-Policy "strict-origin-when-cross-origin" always;  # limit referrer leakage

Validate the config, reload, then let certbot obtain a certificate and configure HTTPS plus an automatic HTTP to HTTPS redirect.

sudo nginx -t && sudo systemctl reload nginx   # never reload a broken config
sudo apt install -y certbot python3-certbot-nginx
# --redirect adds the 301 from HTTP to HTTPS automatically
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com --redirect

Certbot installs a systemd timer that renews certificates before they expire. Confirm a dry run succeeds.

sudo certbot renew --dry-run        # simulate a renewal end-to-end
systemctl list-timers | grep certbot  # confirm the renewal timer is scheduled