Hey everyone! I'm running a PHP website on an Nginx server hosted in a virtual machine and I'm looking for ways to secure my APIs while keeping them public. We've thought about implementing rate limiting, but I'd love to hear more suggestions on what else can be done to enhance security.
3 Answers
It's important to clarify what you're aiming to protect against. Are you mainly worried about DDoS attacks or are you looking into authentication methods as well? Consider adding geo-restrictions if you notice that attacks come from specific regions. Protecting against bots and potential misuse should definitely be a priority.
Adding additional infrastructure like gateways can help too, but if Cloudflare is not an option, you might need to explore other CDN solutions that focus on security.
One solid step is to set up proper firewall rules and rate limits on your APIs. Additionally, consider using a Web Application Firewall (WAF) to add an extra layer of protection. If you're dealing with potential threats, looking into Network Intrusion Detection Systems (NIDS) or Host Intrusion Detection Systems (HIDS) could also be beneficial. Don't forget to monitor logs closely and integrate them into a SIEM for better insight.
Related Questions
Cloudflare Origin SSL Certificate Setup Guide
How To Effectively Monetize A Site With Ads