---
title: Install and Harden NGINX on Ubuntu
description: "This guide installs NGINX from the Ubuntu repositories, opens only the ports you need, and adds a small set of security headers. It assumes a fresh Ubuntu 24.04 server and a user with `sudo` access. ## What is the safest…"
url: "https://apatecreative.com/knowledge-base/nginx/install-and-harden-nginx-on-ubuntu/"
updated: "2026-10-11"
category: NGINX
---

# Install and Harden NGINX on Ubuntu

This guide installs NGINX from the Ubuntu repositories, opens only the ports you need, and adds a small set of security headers. It assumes a fresh Ubuntu 24.04 server and a user with `sudo` access.

## What is the safest way to install NGINX on Ubuntu?

Install the `nginx` package with apt, allow only HTTP and HTTPS through UFW, and validate every change with `nginx -t` before reloading. This keeps the default packages patched by Ubuntu security updates and avoids exposing unused services, which is the safest baseline for a new server.

## Step 1: Install the package

```
sudo apt update
sudo apt install -y nginx
sudo systemctl enable --now nginx
nginx -v
```

## Step 2: Open only the required ports

```
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
sudo ufw status verbose
```

> Always allow SSH before enabling the firewall, or you can lock yourself out of the server.

## Step 3: Add security headers

Create a snippet you can include in every server block:

```
# /etc/nginx/snippets/security-headers.conf
add_header X-Content-Type-Options 'nosniff' always;
add_header X-Frame-Options 'SAMEORIGIN' always;
add_header Referrer-Policy 'strict-origin-when-cross-origin' always;
add_header Permissions-Policy 'camera=(), microphone=(), geolocation=()' always;
```

## Step 4: Hide the version and test

```
# /etc/nginx/nginx.conf  (inside the http block)
server_tokens off;

# then validate and reload
sudo nginx -t && sudo systemctl reload nginx
```

## Troubleshooting checklist

- **Port already in use:** run `sudo ss -tlnp | grep :80` to find the other service.
- **Config test fails:** read the line number in the error and fix that block first.
- **502 Bad Gateway:** confirm PHP-FPM is running and the socket path matches `fastcgi_pass`.