Secure Nginx Proxy Manager – Best Practices Guide 2026

• Enable Cloudflare Proxy (Orange Cloud).
• Use Full (Strict) SSL mode.
• Enable Always Use HTTPS.
• Enable Bot Protection.
• Configure Web Application Firewall (WAF).

• Do not expose NPM admin port directly to the internet.
• Restrict access using VPN.
• Allow only trusted IP addresses.
• Use strong administrator passwords.
• Enable MFA wherever possible.

docker ps
docker images
docker network ls

• Use official NPM container images.
• Keep Docker updated.
• Remove unused containers.
• Disable unnecessary services.
• Use dedicated Docker networks.

• Use Let's Encrypt certificates.
• Force HTTPS redirection.
• Enable HSTS.
• Disable weak SSL protocols.

Recommended headers:

X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
Content-Security-Policy: default-src 'self';

• Allow only Cloudflare IP ranges.
• Block direct public access.
• Use firewall ACLs.
• Disable unused ports.

• Disable password authentication.
• Use SSH keys only.
• Change default SSH policies.
• Enable Fail2Ban.

Example UFW configuration:

sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo ufw enable

docker logs npm

tail -f /data/logs/*.log

• Review access logs regularly.
• Investigate repeated failed requests.
• Monitor unusual traffic patterns.
• Forward logs to Wazuh SIEM.

• Backup Docker volumes.
• Backup SSL certificates.
• Backup NPM configuration.
• Store backups offsite.

• Use Cloudflare DDoS Protection.
• Enable Rate Limiting.
• Block suspicious countries if needed.
• Monitor traffic spikes.

• Update Ubuntu monthly.
• Update Docker regularly.
• Update NPM container versions.
• Review SSL certificate validity.
• Perform vulnerability scans.

Internet
↓
Cloudflare WAF + DDoS Protection
↓
Nginx Proxy Manager
↓
Docker Applications / Websites
↓
Wazuh Monitoring + Backups