Deploying a certificate is not the end of reverse proxy security. It is the beginning of request processing.

Protect the origin

Backend services should not normally be reachable through the same public path as the proxy. Bind internal listeners to loopback or private addresses and enforce network policy where remote origins are required.

Control request behaviour

Request size, header handling, buffering and timeouts should reflect the application protocol rather than a generic web template. 

client_max_body_size 1m;
proxy_connect_timeout 5s;
proxy_read_timeout 60s;
proxy_send_timeout 60s;

Streaming protocols require different values and often require buffering to be disabled deliberately.

Treat forwarded headers as security data

Applications commonly trust headers such as X-Forwarded-For or X-Forwarded-Proto. The proxy must overwrite untrusted client values rather than forwarding them unchanged.

Design rule: every header used for authorization or audit must have a documented trusted issuer.

Log enough to investigate

Logs should connect the external request, the selected upstream and the response status without collecting unnecessary secrets.