Some of those tips won't be applicable to any real-life server set-up. I mean, for example: ## Start: Size Limits & Buffer Overflows ## client_body_buffer_

Some of those tips won't be applicable to any real-life server set-up. I mean, for example: ## Start: Size Limits & Buffer Overflows ## client_body_buffer_size 1K; client_header_buffer_size 1k; client_max_body_size 1k; large_client_header_buffers 2 1k; Many web-apps will need larger request and body sizes than this! And I'm not sure why setting a buffer size protects from buffer overflows. Why does a 1k size work better than a 16k size? If the buffer is used correctly, it shouldn't overflow, no matter its size... Seems to me that cargo-culting this set of "best practices" is a good way to DoS your own server. Who needs crackers when you can do it all yourself?