A Minimal TLS and HSTS Checklist for a Self-Managed VPS

Managing SSL yourself on a VPS (instead of an automatic platform like Vercel/Netlify) means you’re fully responsible for the TLS configuration. Here’s what’s set up in Nginx for gookkis.com.

Certbot for certificates. Let’s Encrypt via Certbot, with auto-renewal through certbot’s built-in cron/systemd timer. Nothing to think about again as long as the server keeps running.

Restrict TLS protocols. I set ssl_protocols TLSv1.2 TLSv1.3; — disabling older TLS versions (1.0/1.1) that are already considered insecure and unsupported by modern browsers anyway. There’s no reason to keep supporting old protocols on a new site.

HSTS header. Strict-Transport-Security with max-age=31536000; includeSubDomains forces browsers to always connect over HTTPS to this domain (and its subdomains) for the next year, even if a user types http:// manually. This closes the downgrade-attack window on the first request.

Extra security headers. X-Frame-Options: SAMEORIGIN to prevent clickjacking, X-Content-Type-Options: nosniff to stop browsers from guessing a file’s MIME type in ways that can be abused.

Forced redirect. Every request to port 80 (http://) gets a 301 redirect to https:// in a separate server block, before it can hit any SSL logic at all.

This isn’t the most advanced configuration out there — no custom OCSP stapling or hand-tuned cipher suites. But for a personal static site, the priority is not missing any of the basics, not squeezing out enterprise-level optimization. This simple checklist covers that.