{"id":84683,"date":"2026-07-26T16:09:17","date_gmt":"2026-07-26T08:09:17","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/84683.html"},"modified":"2026-07-26T16:09:17","modified_gmt":"2026-07-26T08:09:17","slug":"%e3%80%90%e6%9c%8d%e5%8a%a1%e5%99%a8%e7%9f%a5%e8%af%86%e3%80%91nginx%e5%ae%89%e5%85%a8%e6%9e%b6%e6%9e%84%e5%b7%a1%e6%a3%80","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/84683.html","title":{"rendered":"\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0"},"content":{"rendered":"<\/p>\n<h4>nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0<\/h4>\n<ul>\n<li>\u4e00\u3001Nginx\u9762\u5411\u4e92\u8054\u7f51\u7684\u6838\u5fc3\u5b89\u5168\u98ce\u9669\u6e05\u5355<\/li>\n<li>\u4e8c\u3001\u5206\u7ef4\u5ea6\u5b89\u5168\u52a0\u56fa\u65b9\u6848&#xff08;\u542b\u914d\u7f6e\u793a\u4f8b&#xff09;<\/li>\n<li>\n<ul>\n<li>1. \u57fa\u7840\u914d\u7f6e\u5b89\u5168&#xff08;\u6d88\u9664\u9ed8\u8ba4\u98ce\u9669&#xff09;<\/li>\n<li>\n<ul>\n<li>1.1 \u9690\u85cf\u7248\u672c\u53f7\u4e0e\u654f\u611f\u4fe1\u606f<\/li>\n<li>1.2 \u7981\u7528\u5371\u9669\u6a21\u5757\u4e0e\u529f\u80fd<\/li>\n<li>1.3 \u9632\u6b62\u76ee\u5f55\u904d\u5386\u4e0e\u8def\u5f84\u7a7f\u8d8a<\/li>\n<\/ul>\n<\/li>\n<li>2. \u4f20\u8f93\u5b89\u5168&#xff08;\u5f3a\u5236HTTPS\u4e0e\u52a0\u5bc6\u52a0\u56fa&#xff09;<\/li>\n<li>\n<ul>\n<li>2.1 \u5168\u7ad9HTTPS\u4e0eHSTS<\/li>\n<li>2.2 \u5f3a\u5316SSL\/TLS\u914d\u7f6e<\/li>\n<\/ul>\n<\/li>\n<li>3. \u8bbf\u95ee\u63a7\u5236\u4e0e\u6743\u9650\u7ba1\u7406<\/li>\n<li>\n<ul>\n<li>3.1 IP\u767d\u540d\u5355\u4e0e\u9ed1\u540d\u5355<\/li>\n<li>3.2 \u8bf7\u6c42\u9650\u6d41\u4e0e\u8fde\u63a5\u63a7\u5236<\/li>\n<li>3.3 \u57fa\u672c\u8ba4\u8bc1\u4e0eToken\u6821\u9a8c<\/li>\n<\/ul>\n<\/li>\n<li>4. \u6f0f\u6d1e\u9632\u62a4&#xff08;\u9632XSS\/CSRF\/\u6ce8\u5165&#xff09;<\/li>\n<li>\n<ul>\n<li>4.1 \u5b89\u5168\u54cd\u5e94\u5934&#xff08;\u6838\u5fc3\u9632\u62a4&#xff09;<\/li>\n<li>4.2 \u9632SQL\u6ce8\u5165\u4e0e\u6076\u610f\u8f93\u5165<\/li>\n<li>4.3 \u6587\u4ef6\u4e0a\u4f20\u5b89\u5168<\/li>\n<\/ul>\n<\/li>\n<li>5. \u65e5\u5fd7\u4e0e\u76d1\u63a7&#xff08;\u53ef\u8ffd\u6eaf\u6027&#xff09;<\/li>\n<li>\n<ul>\n<li>5.1 \u5b8c\u6574\u8bbf\u95ee\u65e5\u5fd7\u914d\u7f6e<\/li>\n<li>5.2 \u65e5\u5fd7\u8f6e\u8f6c\u4e0e\u96c6\u4e2d\u5ba1\u8ba1<\/li>\n<\/ul>\n<\/li>\n<li>6. \u7cfb\u7edf\u7ea7\u5b89\u5168&#xff08;\u5e95\u5c42\u9632\u62a4&#xff09;<\/li>\n<li>\n<ul>\n<li>6.1 \u6700\u5c0f\u6743\u9650\u8fd0\u884c<\/li>\n<li>6.2 \u5b9a\u671f\u66f4\u65b0\u4e0e\u6f0f\u6d1e\u626b\u63cf<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>\u4e09\u3001\u914d\u7f6e\u9a8c\u8bc1\u4e0e\u6d4b\u8bd5<\/li>\n<li>\u56db\u3001\u603b\u7ed3&#xff1a;\u5b89\u5168\u67b6\u6784\u5e08\u884c\u52a8\u6e05\u5355<\/li>\n<li>\u5173\u8054\u77e5\u8bc6\u6e05\u5355<\/li>\n<\/ul>\n<h2>\u4e00\u3001Nginx\u9762\u5411\u4e92\u8054\u7f51\u7684\u6838\u5fc3\u5b89\u5168\u98ce\u9669\u6e05\u5355<\/h2>\n<table>\n<tr>\u98ce\u9669\u7c7b\u522b\u5178\u578b\u95ee\u9898\u6f5c\u5728\u5f71\u54cd<\/tr>\n<tbody>\n<tr>\n<td>\u914d\u7f6e\u66b4\u9732<\/td>\n<td>\u663e\u793aNginx\u7248\u672c\u53f7\u3001\u542f\u7528\u76ee\u5f55\u904d\u5386\u3001\u9ed8\u8ba4\u9519\u8bef\u9875\u6cc4\u9732\u4fe1\u606f<\/td>\n<td>\u653b\u51fb\u8005\u5229\u7528\u5df2\u77e5\u7248\u672c\u6f0f\u6d1e\u7cbe\u51c6\u653b\u51fb<\/td>\n<\/tr>\n<tr>\n<td>\u4f20\u8f93\u4e0d\u5b89\u5168<\/td>\n<td>\u672a\u542f\u7528HTTPS\u3001\u5f31\u52a0\u5bc6\u5957\u4ef6&#xff08;\u5982RC4&#xff09;\u3001SSLv3\/TLS1.0\u9057\u7559<\/td>\n<td>\u4e2d\u95f4\u4eba\u653b\u51fb\u3001\u6570\u636e\u7a83\u542c\/\u7be1\u6539<\/td>\n<\/tr>\n<tr>\n<td>\u8bbf\u95ee\u63a7\u5236\u7f3a\u5931<\/td>\n<td>\u65e0IP\u767d\u540d\u5355\u3001\u672a\u9650\u5236HTTP\u65b9\u6cd5&#xff08;\u5982PUT\/DELETE&#xff09;\u3001\u533f\u540d\u8bbf\u95ee\u654f\u611f\u8def\u5f84<\/td>\n<td>\u672a\u6388\u6743\u8bbf\u95ee\u3001\u6076\u610f\u6587\u4ef6\u4e0a\u4f20\/\u5220\u9664<\/td>\n<\/tr>\n<tr>\n<td>\u6f0f\u6d1e\u5229\u7528<\/td>\n<td>\u672a\u8fc7\u6ee4\u6076\u610fUser-Agent\u3001\u5141\u8bb8\u6267\u884cCGI\/PHP\u3001\u6587\u4ef6\u4e0a\u4f20\u65e0\u6821\u9a8c<\/td>\n<td>\u4ee3\u7801\u6267\u884c\u3001XSS\/CSRF\u3001Webshell\u690d\u5165<\/td>\n<\/tr>\n<tr>\n<td>DDoS\u653e\u5927<\/td>\n<td>\u65e0\u8bf7\u6c42\u9650\u6d41\u3001\u957f\u8fde\u63a5\u6ee5\u7528\u3001\u9759\u6001\u8d44\u6e90\u672a\u7f13\u5b58<\/td>\n<td>\u670d\u52a1\u4e0d\u53ef\u7528\u3001\u5e26\u5bbd\u8017\u5c3d<\/td>\n<\/tr>\n<tr>\n<td>\u65e5\u5fd7\u4e0e\u76d1\u63a7\u7f3a\u5931<\/td>\n<td>\u672a\u8bb0\u5f55\u5173\u952e\u8bbf\u95ee\u65e5\u5fd7\u3001\u65e0\u5f02\u5e38\u884c\u4e3a\u544a\u8b66<\/td>\n<td>\u653b\u51fb\u4e8b\u4ef6\u8ffd\u6eaf\u56f0\u96be\u3001\u65e0\u6cd5\u53ca\u65f6\u53d1\u73b0\u5165\u4fb5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u4e8c\u3001\u5206\u7ef4\u5ea6\u5b89\u5168\u52a0\u56fa\u65b9\u6848&#xff08;\u542b\u914d\u7f6e\u793a\u4f8b&#xff09;<\/h2>\n<p>\u4ee5\u4e0b\u914d\u7f6e\u57fa\u4e8eNginx 1.25&#043;&#xff08;\u63a8\u8350\u6700\u65b0\u7a33\u5b9a\u7248&#xff09;&#xff0c;\u9700\u6839\u636e\u5b9e\u9645\u4e1a\u52a1\u8c03\u6574\u3002<\/p>\n<h3>1. \u57fa\u7840\u914d\u7f6e\u5b89\u5168&#xff08;\u6d88\u9664\u9ed8\u8ba4\u98ce\u9669&#xff09;<\/h3>\n<h4>1.1 \u9690\u85cf\u7248\u672c\u53f7\u4e0e\u654f\u611f\u4fe1\u606f<\/h4>\n<p>\u98ce\u9669&#xff1a;\u9ed8\u8ba4\u54cd\u5e94\u5934Server: nginx\/1.x.x\u66b4\u9732\u7248\u672c&#xff0c;\u653b\u51fb\u8005\u53ef\u9488\u5bf9\u6027\u5229\u7528\u6f0f\u6d1e&#xff08;\u5982CVE-2021-23017&#xff09;\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<p>http {<br \/>\n  server_tokens off;  # \u9690\u85cf\u7248\u672c\u53f7&#xff08;\u4ec5\u663e\u793a&#034;nginx&#034;&#xff09;<br \/>\n  more_clear_headers &#039;Server&#039;;  # \u5f7b\u5e95\u79fb\u9664Server\u5934&#xff08;\u9700ngx_headers_more\u6a21\u5757&#xff09;<br \/>\n}<\/p>\n<h4>1.2 \u7981\u7528\u5371\u9669\u6a21\u5757\u4e0e\u529f\u80fd<\/h4>\n<p>\u98ce\u9669&#xff1a;\u9ed8\u8ba4\u542f\u7528\u7684autoindex&#xff08;\u76ee\u5f55\u5217\u8868&#xff09;\u3001ssi&#xff08;\u670d\u52a1\u5668\u7aef\u5305\u542b&#xff09;\u3001autoindex_exact_size\u53ef\u80fd\u6cc4\u9732\u6587\u4ef6\u7ed3\u6784\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<p>http {<br \/>\n  # \u7981\u7528\u76ee\u5f55\u904d\u5386&#xff08;\u6838\u5fc3&#xff01;&#xff09;<br \/>\n  autoindex off;<br \/>\n  # \u7981\u7528SSI&#xff08;\u907f\u514d\u4ee3\u7801\u6ce8\u5165&#xff09;<br \/>\n  ssi off;<br \/>\n  # \u7981\u7528\u4e0d\u5fc5\u8981\u7684HTTP\u65b9\u6cd5&#xff08;\u4ec5\u4fdd\u7559GET\/POST\/HEAD&#xff09;<br \/>\n  limit_except GET POST HEAD {<br \/>\n    deny all;<br \/>\n  }<br \/>\n}<\/p>\n<h4>1.3 \u9632\u6b62\u76ee\u5f55\u904d\u5386\u4e0e\u8def\u5f84\u7a7f\u8d8a<\/h4>\n<p>\u98ce\u9669&#xff1a;\u82e5\u914d\u7f6e\u4e0d\u5f53&#xff08;\u5982alias\u4e0eroot\u6df7\u7528&#xff09;&#xff0c;\u653b\u51fb\u8005\u53ef\u8bbf\u95ee\/etc\/passwd\u7b49\u654f\u611f\u6587\u4ef6\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u7981\u6b62\u4f7f\u7528alias\u6307\u5411\u7cfb\u7edf\u76ee\u5f55&#xff0c;\u4f18\u5148\u7528root&#xff1b;<\/li>\n<li>\u5bf9\u52a8\u6001\u8def\u5f84\u6dfb\u52a0\u6b63\u5219\u6821\u9a8c&#xff1a;<\/li>\n<\/ul>\n<p>location ~* ^\/(?!static\/).*\\\\.(php|jsp)$ {<br \/>\n  deny all;  # \u7981\u6b62\u76f4\u63a5\u8bbf\u95ee\u811a\u672c\u6587\u4ef6&#xff08;\u9700\u901a\u8fc7FastCGI\u8f6c\u53d1&#xff09;<br \/>\n}<\/p>\n<p>location \/uploads\/ {<br \/>\n  # \u9650\u5236\u4e0a\u4f20\u76ee\u5f55\u4ec5\u5141\u8bb8\u7279\u5b9a\u6587\u4ef6\u7c7b\u578b<br \/>\n  if ($request_filename !~* \\\\.(jpg|png|pdf)$) {<br \/>\n    return 403;<br \/>\n  }<br \/>\n}<\/p>\n<h3>2. \u4f20\u8f93\u5b89\u5168&#xff08;\u5f3a\u5236HTTPS\u4e0e\u52a0\u5bc6\u52a0\u56fa&#xff09;<\/h3>\n<h4>2.1 \u5168\u7ad9HTTPS\u4e0eHSTS<\/h4>\n<p>\u98ce\u9669&#xff1a;HTTP\u660e\u6587\u4f20\u8f93\u6613\u88ab\u7a83\u542c&#xff0c;\u7f3a\u4e4fHSTS\u5bfc\u81f4\u964d\u7ea7\u653b\u51fb\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u7533\u8bf7\u514d\u8d39\u8bc1\u4e66&#xff08;Let\u2019s Encrypt&#xff09;&#xff0c;\u914d\u7f6e\u81ea\u52a8\u7eed\u671f&#xff1b;<\/li>\n<li>\u5f3a\u5236HTTP\u2192HTTPS\u8df3\u8f6c&#xff0c;\u542f\u7528HSTS&#xff1a;<\/li>\n<\/ul>\n<p>server {<br \/>\n  listen 80;<br \/>\n  server_name example.com;<br \/>\n  return 301 https:\/\/$host$request_uri;  # HTTP\u5f3a\u5236\u8df3\u8f6cHTTPS<br \/>\n}<\/p>\n<p>server {<br \/>\n  listen 443 ssl http2;  # \u542f\u7528HTTP\/2\u63d0\u5347\u6027\u80fd<br \/>\n  server_name example.com;<\/p>\n<p>  # SSL\u8bc1\u4e66\u914d\u7f6e<br \/>\n  ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;<br \/>\n  ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;<\/p>\n<p>  # HSTS&#xff08;\u5f3a\u5236\u6d4f\u89c8\u5668\u4f7f\u7528HTTPS&#xff0c;\u6709\u6548\u671f1\u5e74&#xff09;<br \/>\n  add_header Strict-Transport-Security &#034;max-age&#061;31536000; includeSubDomains; preload&#034; always;<br \/>\n}<\/p>\n<h4>2.2 \u5f3a\u5316SSL\/TLS\u914d\u7f6e<\/h4>\n<p>\u98ce\u9669&#xff1a;\u5f31\u52a0\u5bc6\u5957\u4ef6&#xff08;\u5982RC4\u3001DES&#xff09;\u3001\u8fc7\u65f6\u534f\u8bae&#xff08;SSLv3\/TLS1.0\/1.1&#xff09;\u53ef\u88ab\u7834\u89e3\u3002 \u5904\u7f6e&#xff1a;\u4f7f\u7528Mozilla\u63a8\u8350\u7684\u5b89\u5168\u914d\u7f6e&#xff08;https:\/\/wiki.mozilla.org\/Security\/Server_Side_TLS&#xff09;&#xff1a;<\/p>\n<p>ssl_protocols TLSv1.2 TLSv1.3;  # \u7981\u7528SSLv3\/TLS1.0\/1.1<br \/>\nssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;<br \/>\nssl_prefer_server_ciphers on;  # \u4f18\u5148\u4f7f\u7528\u670d\u52a1\u7aef\u52a0\u5bc6\u5957\u4ef6<br \/>\nssl_session_timeout 1d;  # \u4f1a\u8bdd\u8d85\u65f61\u5929<br \/>\nssl_session_cache shared:SSL:10m;  # \u5171\u4eab\u4f1a\u8bdd\u7f13\u5b58&#xff08;10MB&#xff09;<br \/>\nssl_stapling on;  # \u542f\u7528OCSP Stapling&#xff08;\u52a0\u901f\u8bc1\u4e66\u9a8c\u8bc1&#xff09;<br \/>\nssl_stapling_verify on;<br \/>\nresolver 8.8.8.8 1.1.1.1 valid&#061;300s;  # DNS\u89e3\u6790\u5668&#xff08;\u7528\u4e8eOCSP&#xff09;<\/p>\n<h3>3. \u8bbf\u95ee\u63a7\u5236\u4e0e\u6743\u9650\u7ba1\u7406<\/h3>\n<h4>3.1 IP\u767d\u540d\u5355\u4e0e\u9ed1\u540d\u5355<\/h4>\n<p>\u98ce\u9669&#xff1a;\u672a\u9650\u5236\u6765\u6e90IP\u5bfc\u81f4\u516c\u7f51\u4efb\u610f\u8bbf\u95ee&#xff08;\u5982\u7ba1\u7406\u540e\u53f0&#xff09;\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u5bf9\u654f\u611f\u8def\u5f84&#xff08;\u5982\/admin&#xff09;\u914d\u7f6eIP\u767d\u540d\u5355&#xff1a;<\/li>\n<\/ul>\n<p>location \/admin\/ {<br \/>\n  allow 192.168.1.0\/24;  # \u5185\u7f51IP\u6bb5<br \/>\n  allow 10.0.0.1;         # \u7279\u5b9a\u7ba1\u7406IP<br \/>\n  deny all;               # \u62d2\u7edd\u5176\u4ed6\u6240\u6709IP<br \/>\n  auth_basic &#034;Admin Area&#034;;  # \u53e0\u52a0\u57fa\u672c\u8ba4\u8bc1<br \/>\n  auth_basic_user_file \/etc\/nginx\/.htpasswd;<br \/>\n}<\/p>\n<h4>3.2 \u8bf7\u6c42\u9650\u6d41\u4e0e\u8fde\u63a5\u63a7\u5236<\/h4>\n<p>\u98ce\u9669&#xff1a;\u65e0\u9650\u5236\u8bf7\u6c42\u5bfc\u81f4DDoS\u6216\u8d44\u6e90\u8017\u5c3d&#xff08;\u5982CC\u653b\u51fb&#xff09;\u3002 \u5904\u7f6e&#xff1a;\u4f7f\u7528ngx_http_limit_req_module\u548cngx_http_limit_conn_module&#xff1a;<\/p>\n<p>http {<br \/>\n  # \u9650\u6d41\u914d\u7f6e&#xff1a;\u6bcf\u79d2\u6700\u591a10\u4e2a\u8bf7\u6c42&#xff08;\u7a81\u53d150\u4e2a&#xff09;<br \/>\n  limit_req_zone $binary_remote_addr zone&#061;req_limit:10m rate&#061;10r\/s;<br \/>\n  # \u8fde\u63a5\u6570\u9650\u5236&#xff1a;\u5355IP\u6700\u591a20\u4e2a\u5e76\u53d1\u8fde\u63a5<br \/>\n  limit_conn_zone $binary_remote_addr zone&#061;conn_limit:10m;<\/p>\n<p>  server {<br \/>\n    location \/ {<br \/>\n      limit_req zone&#061;req_limit burst&#061;50 nodelay;  # \u7a81\u53d1\u8bf7\u6c42\u4e0d\u5ef6\u8fdf\u5904\u7406<br \/>\n      limit_conn conn_limit 20;  # \u5355IP\u5e76\u53d1\u8fde\u63a5\u9650\u5236<br \/>\n    }<br \/>\n  }<br \/>\n}<\/p>\n<h4>3.3 \u57fa\u672c\u8ba4\u8bc1\u4e0eToken\u6821\u9a8c<\/h4>\n<p>\u98ce\u9669&#xff1a;\u654f\u611f\u63a5\u53e3&#xff08;\u5982API&#xff09;\u65e0\u8ba4\u8bc1\u5bfc\u81f4\u672a\u6388\u6743\u8bbf\u95ee\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u5bf9\u7ba1\u7406\u63a5\u53e3\u4f7f\u7528auth_basic&#xff08;\u914d\u5408.htpasswd\u6587\u4ef6&#xff09;&#xff1b;<\/li>\n<li>\u5bf9API\u63a5\u53e3\u4f7f\u7528Token\u6821\u9a8c&#xff08;\u5982JWT&#xff09;&#xff1a;<\/li>\n<\/ul>\n<p>location \/api\/ {<br \/>\n  if ($http_authorization !~* &#034;Bearer [A-Za-z0-9-_.]&#043;&#034;) {<br \/>\n    return 401;  # \u65e0\u6548Token\u8fd4\u56de401<br \/>\n  }<br \/>\n  proxy_pass http:\/\/backend_api;<br \/>\n}<\/p>\n<h3>4. \u6f0f\u6d1e\u9632\u62a4&#xff08;\u9632XSS\/CSRF\/\u6ce8\u5165&#xff09;<\/h3>\n<h4>4.1 \u5b89\u5168\u54cd\u5e94\u5934&#xff08;\u6838\u5fc3\u9632\u62a4&#xff09;<\/h4>\n<p>\u98ce\u9669&#xff1a;\u7f3a\u4e4f\u5b89\u5168\u5934\u5bfc\u81f4XSS\u3001\u70b9\u51fb\u52ab\u6301\u3001MIME\u55c5\u63a2\u7b49\u653b\u51fb\u3002 \u5904\u7f6e&#xff1a;\u6dfb\u52a0\u4ee5\u4e0b\u54cd\u5e94\u5934&#xff08;\u5168\u5c40\u914d\u7f6e&#xff09;&#xff1a;<\/p>\n<p>add_header X-Frame-Options &#034;DENY&#034; always;  # \u7981\u6b62iframe\u5d4c\u5957&#xff08;\u9632\u70b9\u51fb\u52ab\u6301&#xff09;<br \/>\nadd_header X-XSS-Protection &#034;1; mode&#061;block&#034; always;  # \u542f\u7528XSS\u8fc7\u6ee4\u5668<br \/>\nadd_header X-Content-Type-Options &#034;nosniff&#034; always;  # \u7981\u6b62MIME\u7c7b\u578b\u55c5\u63a2<br \/>\nadd_header Content-Security-Policy &#034;default-src &#039;self&#039;; script-src &#039;self&#039; &#039;unsafe-inline&#039; cdn.example.com; style-src &#039;self&#039; &#039;unsafe-inline&#039;; img-src &#039;self&#039; data:;&#034; always;  # CSP\u7b56\u7565&#xff08;\u6309\u9700\u8c03\u6574&#xff09;<br \/>\nadd_header Referrer-Policy &#034;strict-origin-when-cross-origin&#034; always;  # \u9650\u5236Referer\u5934<\/p>\n<h4>4.2 \u9632SQL\u6ce8\u5165\u4e0e\u6076\u610f\u8f93\u5165<\/h4>\n<p>\u98ce\u9669&#xff1a;\u672a\u8fc7\u6ee4\u7528\u6237\u8f93\u5165\u5bfc\u81f4SQL\u6ce8\u5165\u3001\u547d\u4ee4\u6ce8\u5165\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u5bf9\u52a8\u6001\u53c2\u6570\u4f7f\u7528\u6b63\u5219\u6821\u9a8c&#xff08;\u5982\u4ec5\u5141\u8bb8\u5b57\u6bcd\u6570\u5b57&#xff09;&#xff1a;<\/li>\n<\/ul>\n<p>location ~* ^\/search\/(.*)$ {<br \/>\n  if ($1 !~* &#034;^[a-zA-Z0-9_-]&#043;$&#034;) {<br \/>\n    return 400;  # \u975e\u6cd5\u5b57\u7b26\u8fd4\u56de400<br \/>\n  }<br \/>\n  proxy_pass http:\/\/search_backend\/$1;<br \/>\n}<\/p>\n<ul>\n<li>\u7981\u7528$uri\u548c$document_uri&#xff08;\u53ef\u80fd\u88ab\u7be1\u6539&#xff09;&#xff0c;\u6539\u7528$request_uri&#xff1a;<\/li>\n<\/ul>\n<p>log_format main &#039;$remote_addr [$time_local] &#034;$request_method $request_uri&#034; $status&#039;;  # \u7528$request_uri\u8bb0\u5f55\u539f\u59cb\u8bf7\u6c42<\/p>\n<h4>4.3 \u6587\u4ef6\u4e0a\u4f20\u5b89\u5168<\/h4>\n<p>\u98ce\u9669&#xff1a;\u4e0a\u4f20\u63a5\u53e3\u672a\u6821\u9a8c\u6587\u4ef6\u7c7b\u578b\/\u5927\u5c0f&#xff0c;\u5bfc\u81f4Webshell\u690d\u5165\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u9650\u5236\u6587\u4ef6\u5927\u5c0f&#xff08;client_max_body_size&#xff09;&#xff1b;<\/li>\n<li>\u6821\u9a8c\u6587\u4ef6\u540e\u7f00\u4e0eMIME\u7c7b\u578b&#xff1a;<\/li>\n<\/ul>\n<p>client_max_body_size 10m;  # \u6700\u5927\u4e0a\u4f2010MB<\/p>\n<p>location \/upload {<br \/>\n  # \u6821\u9a8c\u6587\u4ef6\u540e\u7f00&#xff08;\u4ec5\u5141\u8bb8\u56fe\u7247&#xff09;<br \/>\n  if ($request_filename ~* .*\\\\.(php|jsp|sh)$) {<br \/>\n    return 403;<br \/>\n  }<br \/>\n  # \u6821\u9a8cMIME\u7c7b\u578b&#xff08;\u9700ngx_http_core_module\u652f\u6301&#xff09;<br \/>\n  types {<br \/>\n    image\/jpeg jpg jpeg;<br \/>\n    image\/png png;<br \/>\n  }<br \/>\n  default_type application\/octet-stream;  # \u5176\u4ed6\u7c7b\u578b\u89c6\u4e3a\u4e8c\u8fdb\u5236\u6d41<br \/>\n}<\/p>\n<h3>5. \u65e5\u5fd7\u4e0e\u76d1\u63a7&#xff08;\u53ef\u8ffd\u6eaf\u6027&#xff09;<\/h3>\n<h4>5.1 \u5b8c\u6574\u8bbf\u95ee\u65e5\u5fd7\u914d\u7f6e<\/h4>\n<p>\u98ce\u9669&#xff1a;\u65e5\u5fd7\u7f3a\u5931\u5173\u952e\u5b57\u6bb5&#xff08;\u5982User-Agent\u3001Referer&#xff09;&#xff0c;\u65e0\u6cd5\u8ffd\u6eaf\u653b\u51fb\u6e90\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<p>http {<br \/>\n  log_format security &#039;$remote_addr &#8211; $remote_user [$time_local] &#039;<br \/>\n                      &#039;&#034;$request&#034; $status $body_bytes_sent &#039;<br \/>\n                      &#039;&#034;$http_referer&#034; &#034;$http_user_agent&#034; &#039;<br \/>\n                      &#039;&#034;$http_x_forwarded_for&#034; &#034;$request_time&#034;&#039;;  # \u8bb0\u5f55XFF&#xff08;\u4ee3\u7406\u573a\u666f&#xff09;\u548c\u8bf7\u6c42\u8017\u65f6<br \/>\n  access_log \/var\/log\/nginx\/access.log security;  # \u4f7f\u7528\u81ea\u5b9a\u4e49\u683c\u5f0f<br \/>\n  error_log \/var\/log\/nginx\/error.log warn;  # \u9519\u8bef\u65e5\u5fd7\u7ea7\u522b\u8bbe\u4e3awarn&#xff08;\u51cf\u5c11\u5197\u4f59&#xff09;<br \/>\n}<\/p>\n<h4>5.2 \u65e5\u5fd7\u8f6e\u8f6c\u4e0e\u96c6\u4e2d\u5ba1\u8ba1<\/h4>\n<p>\u98ce\u9669&#xff1a;\u65e5\u5fd7\u6587\u4ef6\u8fc7\u5927\u5bfc\u81f4\u78c1\u76d8\u5360\u6ee1&#xff0c;\u6216\u5206\u6563\u5728\u591a\u53f0\u670d\u52a1\u5668\u96be\u4ee5\u5206\u6790\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u4f7f\u7528logrotate\u8f6e\u8f6c\u65e5\u5fd7&#xff08;\u6bcf\u65e5\u5207\u5272&#xff0c;\u4fdd\u755930\u5929&#xff09;&#xff1a; \/etc\/logrotate.d\/nginx\u914d\u7f6e&#xff1a;\/var\/log\/nginx\/*.log {<br \/>\n  daily<br \/>\n  missingok<br \/>\n  rotate 30<br \/>\n  compress<br \/>\n  delaycompress<br \/>\n  notifempty<br \/>\n  create 0640 www-data adm<br \/>\n  postrotate<br \/>\n    systemctl reload nginx<br \/>\n  endscript<br \/>\n}\n <\/li>\n<li>\u96c6\u4e2d\u65e5\u5fd7\u5230ELK\/Graylog&#xff0c;\u914d\u7f6e\u544a\u8b66&#xff08;\u59825xx\u9519\u8bef\u7387\u7a81\u589e\u3001\u5f02\u5e38User-Agent\u8bbf\u95ee&#xff09;\u3002<\/li>\n<\/ul>\n<h3>6. \u7cfb\u7edf\u7ea7\u5b89\u5168&#xff08;\u5e95\u5c42\u9632\u62a4&#xff09;<\/h3>\n<h4>6.1 \u6700\u5c0f\u6743\u9650\u8fd0\u884c<\/h4>\n<p>\u98ce\u9669&#xff1a;Nginx\u4ee5root\u8fd0\u884c&#xff0c;\u88ab\u5165\u4fb5\u540e\u6613\u83b7\u53d6\u7cfb\u7edf\u6743\u9650\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u521b\u5efa\u4e13\u7528\u7528\u6237&#xff08;\u5982www-data&#xff09;&#xff0c;\u964d\u6743\u8fd0\u884c&#xff1a;<span class=\"token function\">useradd<\/span> <span class=\"token parameter variable\">-r<\/span> <span class=\"token parameter variable\">-s<\/span> \/sbin\/nologin www-data  <span class=\"token comment\"># \u521b\u5efa\u7cfb\u7edf\u7528\u6237<\/span><br \/>\n<span class=\"token function\">chown<\/span> <span class=\"token parameter variable\">-R<\/span> www-data:www-data \/var\/log\/nginx \/usr\/share\/nginx\/html  <span class=\"token comment\"># \u7f51\u7ad9\u6587\u4ef6\u5c5e\u4e3b<\/span>\n <\/li>\n<li>\u4fee\u6539Nginx\u542f\u52a8\u7528\u6237&#xff08;nginx.conf\u9996\u884c&#xff09;&#xff1a;user www-data;  # \u975eroot\u7528\u6237\u8fd0\u884c\n <\/li>\n<\/ul>\n<h4>6.2 \u5b9a\u671f\u66f4\u65b0\u4e0e\u6f0f\u6d1e\u626b\u63cf<\/h4>\n<p>\u98ce\u9669&#xff1a;\u65e7\u7248\u672cNginx\u5b58\u5728\u5df2\u77e5\u6f0f\u6d1e&#xff08;\u5982CVE-2023-44487 HTTP\/2\u5feb\u901f\u91cd\u7f6e\u653b\u51fb&#xff09;\u3002 \u5904\u7f6e&#xff1a;<\/p>\n<ul>\n<li>\u5b9a\u671f\u6267\u884cnginx -v\u68c0\u67e5\u7248\u672c&#xff0c;\u901a\u8fc7\u5b98\u65b9\u6e90\u66f4\u65b0&#xff1a;<span class=\"token function\">apt<\/span> update <span class=\"token operator\">&amp;&amp;<\/span> <span class=\"token function\">apt<\/span> upgrade nginx  <span class=\"token comment\"># Debian\/Ubuntu<\/span><br \/>\nyum update nginx  <span class=\"token comment\"># CentOS\/RHEL<\/span>\n <\/li>\n<li>\u4f7f\u7528\u6f0f\u6d1e\u626b\u63cf\u5de5\u5177&#xff08;\u5982Nessus\u3001OpenVAS&#xff09;\u5b9a\u671f\u68c0\u6d4b&#xff0c;\u6216\u5728\u7ebf\u5de5\u5177&#xff08;https:\/\/www.ssllabs.com\/ssltest\/\u3001https:\/\/securityheaders.com\/&#xff09;\u3002<\/li>\n<\/ul>\n<h2>\u4e09\u3001\u914d\u7f6e\u9a8c\u8bc1\u4e0e\u6d4b\u8bd5<\/h2>\n<li>\u68c0\u67e5\u54cd\u5e94\u5934&#xff1a;<span class=\"token function\">curl<\/span> <span class=\"token parameter variable\">-I<\/span> https:\/\/example.com  <span class=\"token comment\"># \u786e\u8ba4\u65e0Server\u7248\u672c\u53f7\u3001\u5b89\u5168\u5934\u5df2\u6dfb\u52a0<\/span>\n <\/li>\n<li>\u6d4b\u8bd5SSL\u914d\u7f6e&#xff1a; \u4f7f\u7528https:\/\/www.ssllabs.com\/ssltest\/\u8bc4\u5206&#xff08;\u76ee\u6807A&#043;&#xff09;\u3002<\/li>\n<li>\u6a21\u62df\u653b\u51fb\u6d4b\u8bd5&#xff1a;\n<ul>\n<li>\u76ee\u5f55\u904d\u5386&#xff1a;curl https:\/\/example.com\/..\/etc\/passwd&#xff08;\u5e94\u8fd4\u56de403&#xff09;&#xff1b;<\/li>\n<li>\u5f31\u52a0\u5bc6&#xff1a;nmap &#8211;script ssl-enum-ciphers -p 443 example.com&#xff08;\u5e94\u65e0RC4\/SSLv3&#xff09;\u3002<\/li>\n<\/ul>\n<\/li>\n<h2>\u56db\u3001\u603b\u7ed3&#xff1a;\u5b89\u5168\u67b6\u6784\u5e08\u884c\u52a8\u6e05\u5355<\/h2>\n<li>\u7acb\u5373\u6574\u6539\u9879&#xff1a;\u9690\u85cf\u7248\u672c\u53f7\u3001\u5f3a\u5236HTTPS\u3001\u6dfb\u52a0\u5b89\u5168\u54cd\u5e94\u5934\u3001\u9650\u5236IP\u8bbf\u95ee\u654f\u611f\u8def\u5f84\u3002<\/li>\n<li>\u4e2d\u671f\u4f18\u5316\u9879&#xff1a;\u914d\u7f6e\u9650\u6d41\u9650\u8fde\u3001\u5b8c\u5584\u65e5\u5fd7\u5ba1\u8ba1\u3001\u5b9e\u65bd\u6587\u4ef6\u4e0a\u4f20\u6821\u9a8c\u3002<\/li>\n<li>\u957f\u671f\u673a\u5236&#xff1a;\u5b9a\u671f\u66f4\u65b0Nginx\u3001\u81ea\u52a8\u5316\u8bc1\u4e66\u7eed\u671f\u3001\u96c6\u6210SIEM\u7cfb\u7edf\u76d1\u63a7\u5f02\u5e38\u3002<\/li>\n<p>\u901a\u8fc7\u4ee5\u4e0a\u914d\u7f6e&#xff0c;\u53ef\u5c06Nginx\u7684\u5b89\u5168\u98ce\u9669\u964d\u4f4e90%\u4ee5\u4e0a&#xff0c;\u6ee1\u8db3\u7b49\u4fdd2.0\/ISO27001\u5bf9Web\u670d\u52a1\u5668\u7684\u5b89\u5168\u8981\u6c42\u3002<\/p>\n<h2>\u5173\u8054\u77e5\u8bc6\u6e05\u5355<\/h2>\n<p>\u3010nginx\u77e5\u8bc6\u3011\u5f04\u61c2nginx\u770b\u8fd9\u4e00\u7bc7\u6587\u7ae0\u5c31\u591f\u4e86<\/p>\n<p>\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u4e0d\u591f&#xff0c;\u90a3\u6211\u4eec\u5c31\u8bd5\u8bd5openresty<\/p>\n<p>\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011Nginx\u8def\u7531\u5339\u914d\u89c4\u5219\u8bf4\u660e<\/p>\n","protected":false},"excerpt":{"rendered":"<p>nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0\u4e00\u3001Nginx\u9762\u5411\u4e92\u8054\u7f51\u7684\u6838\u5fc3\u5b89\u5168\u98ce\u9669\u6e05\u5355\u4e8c\u3001\u5206\u7ef4\u5ea6\u5b89\u5168\u52a0\u56fa\u65b9\u6848&#xff08;\u542b\u914d\u7f6e\u793a\u4f8b&#xff09;1. \u57fa\u7840\u914d\u7f6e\u5b89\u5168&#xff08;\u6d88\u9664\u9ed8\u8ba4\u98ce\u9669&#xff09;1.1 \u9690\u85cf\u7248\u672c\u53f7\u4e0e\u654f\u611f\u4fe1\u606f1.2 \u7981\u7528\u5371\u9669\u6a21\u5757\u4e0e\u529f\u80fd1.3 \u9632\u6b62\u76ee\u5f55\u904d\u5386\u4e0e\u8def\u5f84\u7a7f\u8d8a2. \u4f20\u8f93\u5b89\u5168&#xff08;\u5f3a\u5236HTTPS\u4e0e\u52a0\u5bc6\u52a0\u56fa&#xff09;2.1 \u5168\u7ad9HTTPS\u4e0eHSTS2.2 \u5f3a\u5316SSL\/TLS\u914d\u7f6e3. \u8bbf\u95ee\u63a7\u5236\u4e0e\u6743\u9650\u7ba1\u74063.1 IP\u767d\u540d\u5355\u4e0e\u9ed1\u540d\u53553.2 \u8bf7\u6c42\u9650\u6d41\u4e0e\u8fde\u63a5\u63a7<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[117,1465,43],"topic":[],"class_list":["post-84683","post","type-post","status-publish","format-standard","hentry","category-server","tag-nginx","tag-1465","tag-43"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/84683.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0\u4e00\u3001Nginx\u9762\u5411\u4e92\u8054\u7f51\u7684\u6838\u5fc3\u5b89\u5168\u98ce\u9669\u6e05\u5355\u4e8c\u3001\u5206\u7ef4\u5ea6\u5b89\u5168\u52a0\u56fa\u65b9\u6848&#xff08;\u542b\u914d\u7f6e\u793a\u4f8b&#xff09;1. \u57fa\u7840\u914d\u7f6e\u5b89\u5168&#xff08;\u6d88\u9664\u9ed8\u8ba4\u98ce\u9669&#xff09;1.1 \u9690\u85cf\u7248\u672c\u53f7\u4e0e\u654f\u611f\u4fe1\u606f1.2 \u7981\u7528\u5371\u9669\u6a21\u5757\u4e0e\u529f\u80fd1.3 \u9632\u6b62\u76ee\u5f55\u904d\u5386\u4e0e\u8def\u5f84\u7a7f\u8d8a2. \u4f20\u8f93\u5b89\u5168&#xff08;\u5f3a\u5236HTTPS\u4e0e\u52a0\u5bc6\u52a0\u56fa&#xff09;2.1 \u5168\u7ad9HTTPS\u4e0eHSTS2.2 \u5f3a\u5316SSL\/TLS\u914d\u7f6e3. \u8bbf\u95ee\u63a7\u5236\u4e0e\u6743\u9650\u7ba1\u74063.1 IP\u767d\u540d\u5355\u4e0e\u9ed1\u540d\u53553.2 \u8bf7\u6c42\u9650\u6d41\u4e0e\u8fde\u63a5\u63a7\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/84683.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-26T08:09:17+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/84683.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/84683.html\",\"name\":\"\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-07-26T08:09:17+00:00\",\"dateModified\":\"2026-07-26T08:09:17+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/84683.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/84683.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/84683.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/84683.html","og_locale":"zh_CN","og_type":"article","og_title":"\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0\u4e00\u3001Nginx\u9762\u5411\u4e92\u8054\u7f51\u7684\u6838\u5fc3\u5b89\u5168\u98ce\u9669\u6e05\u5355\u4e8c\u3001\u5206\u7ef4\u5ea6\u5b89\u5168\u52a0\u56fa\u65b9\u6848&#xff08;\u542b\u914d\u7f6e\u793a\u4f8b&#xff09;1. \u57fa\u7840\u914d\u7f6e\u5b89\u5168&#xff08;\u6d88\u9664\u9ed8\u8ba4\u98ce\u9669&#xff09;1.1 \u9690\u85cf\u7248\u672c\u53f7\u4e0e\u654f\u611f\u4fe1\u606f1.2 \u7981\u7528\u5371\u9669\u6a21\u5757\u4e0e\u529f\u80fd1.3 \u9632\u6b62\u76ee\u5f55\u904d\u5386\u4e0e\u8def\u5f84\u7a7f\u8d8a2. \u4f20\u8f93\u5b89\u5168&#xff08;\u5f3a\u5236HTTPS\u4e0e\u52a0\u5bc6\u52a0\u56fa&#xff09;2.1 \u5168\u7ad9HTTPS\u4e0eHSTS2.2 \u5f3a\u5316SSL\/TLS\u914d\u7f6e3. \u8bbf\u95ee\u63a7\u5236\u4e0e\u6743\u9650\u7ba1\u74063.1 IP\u767d\u540d\u5355\u4e0e\u9ed1\u540d\u53553.2 \u8bf7\u6c42\u9650\u6d41\u4e0e\u8fde\u63a5\u63a7","og_url":"https:\/\/www.wsisp.com\/helps\/84683.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-07-26T08:09:17+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"5 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/84683.html","url":"https:\/\/www.wsisp.com\/helps\/84683.html","name":"\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-07-26T08:09:17+00:00","dateModified":"2026-07-26T08:09:17+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/84683.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/84683.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/84683.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u3010\u670d\u52a1\u5668\u77e5\u8bc6\u3011nginx\u5b89\u5168\u67b6\u6784\u5de1\u68c0"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/84683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=84683"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/84683\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=84683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=84683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=84683"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=84683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}