There is no need to over-optimize everything. Just wait.

Hi Yes,
Ok wait mean when to decide to optimise ? What to monitor ? How about security and protection on the nginx?

Security and protection mostly comes from your OS, not from the web server.

"What to monitor": TCP load should be good.

Hi Yes,
Can I just run the top command and get this monnitoring done? I mean what commands to use to monitor like benchmarking or comparing it ? The load is it he 3 values ? So I am using centos 7 I do regular updates and using minimal installation. What else you recommend for the security? For nginx is it worth for me to install mod_security does it help ?

top/htop is adequate for watching the system load. Traffic measurements are more reliable with Nagios etc.

mod_* is for Apache. I'm pretty sure that this slowly becomes off topic though.

nginx is fine. The weak part will be the PHP or more specifically whatever is written in PHP. If you can do without it your server maintenance, and thus security, will be better.

What kind of 'web app' do you have? Some of the most important things to look for are:

• Always validate input before even considering it for use in the program. If your language supports a taint mode, use that too.
  
• If you have a database backend, use parameterized queries (placeholders).
  
• Write your programs according to the principle of least privilege.
  
• Be sure your program does not leak debugging info to the public during errors.
  
• Familiarize yourself with the web server logs.
  

There are other more specific recommendations depending on your program.

1 members found this post helpful.

Hi Yes,
Do you suggest for me to install nagios on my current system or have separate system to monitor this ? Sorry I am asking some details though cause would like to harden on the nginx and get prepared earlier for circumstance e.g. ddos attacks etc.

You don't need to harden the web server software. The bottleneck is elsewhere as described by @Turbocapitalist above.

re:Nagios, please refer to the Nagios handbook.

Off to work - maybe someone else will fill in now.

Hi Turbocapalist,
Ok about nginx I shall leave it then but I dont know when I google I find a lot of things on hardening and security. I will go with you suggestion on PHP. Yes my back is using PHP fully for both web and app. My web is basically linking to backend mysql db. The web server is facing the internet and db is always kept locally.
Regarding you suggestions.

Always validate input before even considering it for use in the program. If your language supports a taint mode, use that too. (Yes I am doing both using javascript and also at the PHP level)
If you have a database backend, use parameterized queries (placeholders).(Yes I have implemented on this too)
Write your programs according to the principle of least privilege. (Can you help me more on this)
Be sure your program does not leak debugging info to the public during errors. (I just show the normal errors but I dont know is that leaking or not)
Familiarize yourself with the web server logs.(I need more help on this I am trying to learn this)

"Is this what they teach kids in school today?" To simply throw up your hands and ask vague questions, hoping that someone will give you the answers when you don't even know (yet) what to ask for?

Actually, I'm being serious.

Right now, you seem to have glommed-onto a handful of buzzwords, but you have no earthly idea how the pieces fit. You seriously need to s-t-o-p, and start doing some reading / video-watching in order to get an idea of what is the so-called "big picture" here. You need to acquire some rudimentary understanding of what a web-server and a mobile-app actually are, how they talk to one another (and for what purposes), and how existing apps already do this.

Simply hand-waving that you don't understand, won't get you any understanding. And, this self-education process won't be accomplished in a day. You must have a clear goal in mind ... and your first goal must be to determine what those goals ought to be.

1 members found this post helpful.

Hi Sundia,
Ok let me be clear what currently I am doing.

1. My os is Centos 7
2. Php is Php 7
3. Mysql is Mysql 5.7

Currently there is two version one is the web app and the other is mobile app. I try to split the codes for both web and mobile app but both rely on php to connect to the backend db and send the results accordingly. Well I have done a number hardening on the centos box. I can share what are my steps done too.