No matter if they’re running on a classic physical server, cloud VMs, or in containers, NGINX and PHP-FPM have established themselves as the de-facto standard runtime environment for PHP applications. But what about a production-ready and secure configuration of these two components? Even though, of course, the default settings seemingly work just fine, a really secure system is unfortunately often still quite far away. This presentation shows important concepts and will optimize and harden settings for a secure overall production system.