Don't Let Your Website Request Be "Not Secure"

BLUF: To secure a domain in 2026, you need two things: Certbot (Let's Encrypt) for free automatic SSL, and SSH Key Authentication (disabling passwords) for server access. Google Chrome now blocks "http://" sites by default, so SSL is mandatory, not optional.

You bought yourname.tech. It looks cool. But if visitors see a big red "Not Secure" warning URL bar, your credibility as a developer drops to zero.

1. SSL Certificates (The Green Lock)

SSL encrypts the data between your user and your server. The Tool: Let's Encrypt + Certbot.

Step-by-Step for Nginx:

1. Install Certbot:

   sudo apt install certbot python3-certbot-nginx

2. Run the Magic Command:

   sudo certbot --nginx -d yourname.tech -d www.yourname.tech

3. Select Redirect: Choose option "2" to force all traffic to HTTPS.

Fact: 96% of the web is now encrypted. If you aren't, you are an anomaly.

2. Securing Server Access (SSH)

Using a password to login to your server is dangerous. Brute-force bots try root:password123 millions of times a day.

The Fix: SSH Keys

1. Generate a Key Pair (On your PC):

   ssh-keygen -t ed25519 -C "your_email@example.com"

   Note: Ed25519 is faster and more secure than RSA.

2. Copy Public Key to Server:

   ssh-copy-id username@your_server_ip

3. Disable Password Login (On Server): Edit /etc/ssh/sshd_config:

   PasswordAuthentication no
   PermitRootLogin prohibit-password

   Restart SSH: sudo systemctl restart ssh.

Now, only someone with your physical laptop file can login. Even if hackers know your password, the server won't let them type it.

My Personal Observation

I monitor my server logs (/var/log/auth.log). Before I disabled passwords, I saw ~4,000 failed login attempts per day from random IPs in Russia and China. After switching to SSH keys? Zero successful breaches in 3 years.

Key Takeaways

• HTTPS: Mandatory for SEO and trust.
• SSH Keys: The only acceptable way to login.
• UFW: Always enable your firewall (ufw enable).

FAQ

1. Do I need to pay for SSL?

No. Let's Encrypt is free, valid for 90 days, and auto-renews. Paid SSL is only for massive corps needing insurance.

2. What if I lose my SSH private key?

You are locked out. Most VPS providers (DigitalOcean/AWS) have a "Recovery Console" in the browser as a backdoor.

3. Is .tech a good domain extension?

Yes. It is standard for the developer community. Google treats it exactly the same as .com for SEO.