rroethof · October 16, 2015 14:06 · Oct 16, 2015
diff --git a/gistfile1.txt b/gistfile1.txt
@@ -0,0 +1,35 @@
+Stop Hotlinking: don’t let other websites steal your content (images, media files, etc),
+that will cause additional load to your webserver and also more bandwidth consumption.
+
+'''
+location ~ .(gif|png|jpe?g)$ {
+     valid_referers none blocked mywebsite.com *.mywebsite.com;
+     if ($invalid_referer) {
+        return   403;
+    }
+}
+'''
+
+Deny execution of scripts inside certain directories.
+This can be used to protect your websites from being hacked denying execution of scripts inside certain directories (such as tmp, cache, logs, etc), often the ones that need writing permissions.
+ One easy way to secure is the following:
+
+# deny scripts inside writable directories
+'''
+location ~* /(images|cache|media|logs|tmp)/.*.(php|pl|py|jsp|asp|sh|cgi)$ {
+    return 403;
+    error_page 403 /403_error.html;
+}
+'''
+
+Block attackers based on GeoIP countries
+Specify where the GeoIP database is located on your system, you can place this directive inside your http {} configuration block:
+'''geoip_country /etc/nginx/GeoIP.dat;'''
+
+Next, let’s tell Nginx which countries are gonna be blocked:
+
+'''
+if ($geoip_country_code ~ (CN|KR|UK) ) {
+  return 403;
+}
+'''