Configuration - Thinhnam.net

# Security Headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always;

| Record Type | Name/Host | Value/Target | TTL (Recommended) | |-------------|-----------|--------------|-------------------| | | @ (root) | YOUR_SERVER_IPv4 | 300-3600 | | AAAA | @ (root) | YOUR_SERVER_IPv6 (if available) | 300-3600 | | A | www | YOUR_SERVER_IPv4 | 300-3600 | | CNAME | * (wildcard, optional) | thinhnam.net | 3600 | | TXT | @ | v=spf1 mx ~all (basic SPF) | 3600 | | TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@thinhnam.net | 3600 | Thinhnam.net Configuration

ErrorLog $APACHE_LOG_DIR/thinhnam_error.log CustomLog $APACHE_LOG_DIR/thinhnam_access.log combined </VirtualHost> Obtain a free Let’s Encrypt certificate: add_header X-Content-Type-Options "nosniff" always

<Directory /var/www/thinhnam.net/html> Options -Indexes +FollowSymLinks AllowOverride All Require all granted </Directory> ssl_protocols TLSv1.2 TLSv1.3

ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256; ssl_prefer_server_ciphers off; ssl_session_timeout 1d; ssl_session_cache shared:SSL:10m; ssl_session_tickets off; | Measure | Command / Action | |---------|------------------| | Disable directory listing | Nginx: autoindex off; / Apache: Options -Indexes | | Remove server version | Nginx: server_tokens off; / Apache: ServerSignature Off | | Limit upload size | client_max_body_size 10M; (Nginx) or LimitRequestBody 10485760 (Apache) | | Block bad bots | Use if ($http_user_agent ~* (badbot|scraper)) return 403; (Nginx) | | Regular updates | sudo apt update && sudo apt upgrade | 6. Email Configuration (If Self-Hosting) Install a mail stack (Postfix + Dovecot):

# Root directory root /var/www/thinhnam.net/html; index index.html index.php;