HTTP

• Security

Basics

• http://en.wikipedia.org/wiki/Httpd
• http://httpstatus.es/

• http://accs-net.com/hosts/hostsforlinux.html
• http://hosts-file.net/

• HTTPie is a CLI, cURL-like tool for humans

• httpbin(1) - HTTP Request & Response Service

User and group

See also *nix#Users

• What user should apache and PHP be running as? What permissions should /var/www files have?

• http://serverfault.com/questions/260756/allow-scp-ssh-for-www-data-user

Servers

• h5ai makes browsing directories on HTTP web servers more pleasant. Directory listings get styled in a modern way and browsing through the directories is enhanced by different views, a breadcrumb and a tree overview.
  • https://github.com/lrsjng/h5ai

Nginx

• nginx [engine x] is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Igor Sysoev started development of Nginx in 2002, with the first public release in 2004. Nginx now hosts nearly 12.18% (22.2M) of active sites across all domains. Nginx is known for its high performance, stability, rich feature set, simple configuration, and low resource consumption.

• Wiki
  • Resources

Guides

• Nginx Primer - Jul 19, 2010
• Nginx Primer 2: From Apache to Nginx - Feb 04th, 2011

• agentzh's Nginx Tutorials
• The Architecture of Open Source Applications (Volume 2): Nginx
• https://github.com/dslatten/nginsane

• Varnish as reverse proxy with nginx as web server and SSL terminator - Or, if you like, the nginx-Varnish-nginx sandwich. Jul 24th, 2012

• http://www.shkschneider.me/blog/1323/nginx-security-configuration

Configuration

• Configuration
• FullExample

• Pitfalls

Site setup

Site folder location can vary.

/var/www
  debian
/etc/nginx/html
  arch linux

Create 'Server Block' (vhost) config file in

/etc/nginx/sites-available

and later ln -s them in

/etc/nginx/sites-enabled

• ServerBlockExample - Basic examples
  • Wordpress
  • https://wiki.archlinux.org/index.php/PhpMyAdmin#NGINX_Configuration

Enable logging in vhost conf;

error_log /var/log/nginx-vhostnamehere.log error;

Modules

• Nginx modules must be selected during compile, run-time selection of modules is not currently supported.

• NginxHttpCoreModule

• HttpFastcgiModule
  • FcgiExample - FastCGI example. Keep seperate and include.
  • PHPFcgiExample
  • How to Solve “No input file specified” with PHP and Nginx - Jan 19, 2011

• HttpLimitConnModule - This module makes it possible to limit the number of concurrent connections for a defined key such as, for example, an ip address.
• HttpRewriteModule - rewriting urls
• HttpAuthBasicModule - for directory passwords

Tools

• https://github.com/perusio/nginx_ensite - nginx_ensite and nginx_dissite for quick virtual host enabling and disabling

• http://www.anilcetin.com/convert-apache-htaccess-to-nginx/

• https://github.com/perusio/nginx-cache-inspector

Apache

• Apache HTTP Server
  • http://httpd.apache.org/docs/current/mod/

• Stupid htaccess Tricks
• http://www.askapache.com/hacking/speed-site-caching-cache-control.html
• http://www.xpertdeveloper.com/2011/08/set-expire-headers-using-htaccess/

• The 5G Blacklist helps reduce the number of malicious URL requests that hit your website. It’s one of many ways to improve the security of your site and protect against evil exploits, bad requests, and other nefarious garbage.
  • http://perishablepress.com/6g-beta/

lighttpd

• lighttpd (lighty)
  • lighttpd - wikipedia

Other

• http://monkey-project.com/

Testing

• Browser SOA Debugger - Depending on the view of things this is just an enhanced HTTP output formatter for tcpdump streams, or the ultimate debugger for complex HTTP oriented SOA architectures which visualizes the full HTTP interactions in a readable, reproducible way so that you can see what is actually going on in your backend.

Performance

• Use Server Cache Control to Improve Performance
• http://blog.websitepulse.com/the-importance-of-wordpress-expires-header/ The Importance of the WordPress Expires Header]

Guides

• Google Dev: Make the Web Faster
  • https://developers.google.com/speed/docs/best-practices/caching#LeverageBrowserCaching

• Even Faster Web Sites - Book by Steve Souders

• Caching Tutorial for Web Authors and Webmasters
• A Primer on Web Caching - Jun 23rd, 2012
• How we made Portent.com really freaking fast - May 23, 2012

• serverfault: The strange case of Mr. Time To First Byte

• One Sub Domain Doesn’t Make a CDN - January 3, 2011

Systems

• Varnish is a web application accelerator. You install it in front of your web application and it will speed it up significantly.
  • https://www.varnish-cache.org/docs/3.0/
  • https://www.varnish-software.com/static/book/
  • https://www.varnish-cache.org/trac/

Testing

• Blitz does cloud based load and performance testing ising Sinatra, Rails and node.js.
  • Free: Sprint all you want, Rush all you want, 250 concurrent users, 1 minute rushes

• YSlow, etc.
• http://gtmetrix.com/

Web server logs

Combined Log Format

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined

old skool;

• http://www.webalizer.org/
• http://awstats.sourceforge.net/

Apache

• http://httpd.apache.org/docs/1.3/logs.html

Nginx

• http://wiki.nginx.org/HttpLogModule

error_log  /var/log/nginx/domain.name/error.log;
access_log  /var/log/nginx/domain.name/access.log;

• http://articles.slicehost.com/2010/8/27/reading-nginx-web-logs
• http://gadelkareem.com/2012/07/01/nginx-error-log-reader/

GoAccess

• GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly.
  • man goaccess

Control panels

• http://www.virtualmin.com/
• http://www.webmin.com/

Analytics

Piwik

• Piwik is downloadable, Free/Libre (GPLv3 licensed) real time web analytics software. It provides you with detailed reports on your website visitors; the search engines and keywords they used, the language they speak, your popular pages, and much more.
  • http://piwik.org/latest.zip
  • Trac

• Installation & Optimization
  • Nginx configuration for Piwik [1]

• User Guide
• Log Analytics - combined format logs (apache, nginx)

• Plugins

WordPress

• http://wordpress.org/extend/plugins/wp-piwik/

Google

• Google Analytics