ProxyForgeNginx & Apache config generators
✓ Tested on Nginx 1.27 · Apache 2.4

Basic Protection Generator

Block the probes that hit every server — exposed .git and .env files, leftover backups, known scanner tools — and add a simple rate limit, as Nginx or Apache config.

This is basic protection, not a full WAF. It blocks the most common automated probes using standard Nginx and Apache features — no extra modules. It does not inspect requests for SQL injection or XSS, it doesn't learn or update itself, and a determined attacker can get around user-agent blocks. For real WAF coverage, put a service like Cloudflare in front of your server — see Cloudflare WAF rules that pair with your config.

About this tool

Bots scan every public server for files that should never be online: /.git/config, /.env, backup.sql. This site found its own .git folder being served after a deploy change, which is where this tool came from. The output was tested on real Nginx 1.27 and Apache 2.4 servers during development, including the detail most snippets get wrong: blocking hidden files without also blocking /.well-known/, which Let's Encrypt needs to renew your certificate. See How to use ProxyForge for a walkthrough of every setting.

How it works

STEP 1

Pick Nginx or Apache, then tick the protections you want. Each one is independent.

STEP 2

Copy the result. Part 1 (if shown) goes outside your server block; Part 2 goes inside it.

STEP 3

Test and reload, then check that /.git/config returns 404 and your site still loads.

.git, .env, .svn, .htpasswd and anything else starting with a dot. /.well-known/ stays open for Let's Encrypt.
Files ending in .bak, .old, .orig, .save, .swp, .sql or ~ — editor and database leftovers that often contain passwords.
Refuses requests whose User-Agent names a common attack scanner (sqlmap, Nikto, Nmap, masscan, ZGrab, Nuclei). Easy to fake — it only stops lazy, automated scans.
Stops error pages and headers from advertising your exact Nginx or Apache version.
Slows down floods and brute-force attempts. Over the limit, visitors get 429 Too Many Requests.
A single page load can fetch 20–40 files (CSS, images, scripts), so don't set this too low for a whole site.
Extra requests allowed in a quick burst before the limit kicks in.
Without real-IP setup, every visitor looks like Cloudflare's IP and they'd all share one limit.
nginx-protection.conf ✓ Tested on Nginx 1.27 

      

      

      

      

        
Want protection that keeps up?

        
Know the moment something goes wrong:

        

          

            
              UptimeRobot
              Free uptime monitoring — get alerted if a config change takes your site down.
            
            Get started
          

          

            
              Vultr
              Simple cloud servers with a wide range of data center locations.
            
            Get started
          

        

        
Some links above are affiliate links — signing up through them may earn this site a small commission at no extra cost to you. See the privacy policy for details.