NGINX Abuse Guard Module: Auto-Ban Scanners and Bots
by Danila Vershinin, October 2, 2026
Technical Briefing: NGINX Abuse Guard — Banning Scanners by Response Status, Inside the Worker The Problem Public-facing NGINX servers are continuously probed. Scanners request paths like /wp-login.php, /.env, and /phpmyadmin, producing walls of 404s. Bots hitting locked-down admin endpoints generate 403s. Credential-stuffing runs produce failed logins. The signal is asymmetry: legitimate visitors almost never burst errors, while abusive clients do. Existing tools address this imperfectly: limi…
Read More... NGINX Module Version Mismatch: When APT Lets It Through
by Danila Vershinin, October 1, 2026
Technical Briefing: NGINX Dynamic Module ABI Mismatch — Why apt-get upgrade Can Wedge Your Server The Problem NGINX dynamic modules are validated at load time, not install time. The loader in src/core/ngxmodule.c performs two checks in order: An exact version match: module->version != nginxversion (e.g. 1029008 = 1.29.8 vs 1031005 = 1.31.5). A signature string comparison against NGXMODULESIGNATURE. The signature encodes pointer/type sizes and feature bits (epoll, threads, file AIO, QUIC, SSL) b…
Read More... NGINX ACME Module: Let’s Encrypt SSL Without Certbot
by Danila Vershinin, September 30, 2026
Technical Briefing: Native ACME Support in NGINX via nginx-module-acme The Problem SSL certificate renewal for NGINX has traditionally depended on external tooling — Certbot, cron jobs, Python dependencies, and deploy hooks. That pipeline is a separate moving part from the web server itself, and it has to be maintained alongside it. The Fix NGINX now has a native ACME module (nginx-module-acme) that lets NGINX itself speak ACMEv2 to Let’s Encrypt. Certbot, cron jobs, Python dependencies, and de…
Read More... Trusted IP Lists for FirewallD, NGINX and fail2ban
by Danila Vershinin, September 29, 2026
Technical Briefing: Trusted IP List Packages for FirewallD, NGINX, and fail2ban The Problem Hardcoded allowlists for services like Stripe webhooks, Cloudflare, and Googlebot go stale silently. When vendors rotate their published IP ranges, existing allowlists stop matching — breaking integrations or blocking legitimate traffic without any obvious failure signal. The Fix The GetPageSpeed trusted-lists project packages current, officially published IP ranges for 30+ services as RPM packages. A dn…
Read More... Migrate From the ondrej nginx PPA to GetPageSpeed
by Danila Vershinin, September 28, 2026
Technical Briefing: Migrating Off the Deprecated ondrej/nginx Module Packages The Problem At NGINX 1.28 (stable, announced April 2025), the maintainer of the ondrej nginx PPA dropped the mainline module packages. The stated reasons: recompiling every external module for each upstream patch release is unsustainable, and mainline adoption was low. Separately, Ubuntu’s nginx-extras stopped accepting new third-party modules long ago. The practical consequence is that configs relying on loadmodule l…
Read More... The official Amplify app is now on iPhone
by Danila Vershinin, September 27, 2026
Technical Briefing: GetPageSpeed Amplify iPhone App The Problem F5’s hosted NGINX Amplify reached end of life on January 31, 2026. Users of that service needed a continuing path for the familiar agent-based monitoring of NGINX and related services. The Fix GetPageSpeed Amplify continues to run the familiar agent and a compatible API, with a modern dashboard for monitoring NGINX, Varnish, PHP-FPM, MySQL, and websites. The official iPhone app for GetPageSpeed Amplify is now available. What the Ap…
Read More... NGINX Accept-Language Redirects: No Lua Required
by Danila Vershinin, September 26, 2026
Technical Briefing: NGINX Accept-Language Module — Header-Based Language Detection The Problem Stock NGINX cannot parse the Accept-Language header. Language-based redirects therefore typically require a map block full of regexes, an njs script, or a full OpenResty/Lua layer. Real headers are messy: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, ;q=0.5 They include regional subtags, quality values, spaces, and wildcards — all painful to match correctly. The Fix The NGINX Accept-Language module provides a…
Read More... NGINX Variables: Scope, Handlers, and Common Pitfalls
by Danila Vershinin, September 25, 2026
Technical Briefing: NGINX Variables — Semantics, Caching, and Scope The Problem NGINX variables look like scripting variables but do not behave like them. Three rules govern their behavior, and violating any of them produces either a startup failure or a silent, hard-to-diagnose bug: A variable must be introduced by a directive (set, map, geo) or exported by a module. Referencing anything else causes NGINX to refuse to start with nginx: [emerg] unknown “foo” variable. The name is global to the…
Read More... Serve WP Rocket Cache Directly from Nginx Without PHP
by Danila Vershinin, September 24, 2026
Technical Briefing: WP Rocket Nginx Plugin — Direct Static Cache Delivery The Problem On a self-managed Nginx server running WP Rocket, a cached request still travels the long way around: Nginx → PHP-FPM → PHP cache loader → cached HTML file. The HTML file already exists on disk, but PHP-FPM is still involved in handing it back. That occupies a limited PHP-FPM worker for work Nginx is better suited to do. The cost is most visible during traffic bursts: every direct cache hit that consumes a PHP…
Read More... NGINX ESI: Replace Varnish for Magento 2
by Danila Vershinin, September 22, 2026
Technical Briefing: NGINX ESI as a Varnish Replacement for Magento 2 The Problem Running Magento 2 behind Varnish means operating a second proxy, a second configuration language (VCL), and a second cache lifecycle in the request path — all sitting between NGINX and the application. The question this work addresses is whether NGINX can own the entire edge path itself: proxy, cache, TLS, and ESI fragment assembly, without Varnish. The Implementation nginx-module-esi was built for exactly this pur…
Read More...Recommended Web Hosting
