---
title: Expose only a hardened web server
description: >-
  Put one thing on the internet: a hardened reverse proxy, a cloud load
  balancer, or a managed application host. Keep everything else on a private
  network.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/expose-only-a-hardened-web-server
  md: >-
    https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/expose-only-a-hardened-web-server.md
---

# Expose only a hardened web server

Put one thing on the internet: a hardened reverse proxy, a cloud load balancer, or a managed application host. Keep everything else on a private network.

***

## Why

Reverse proxies such as Nginx and Caddy, cloud load balancers, and managed hosts are widely audited and emit standard telemetry. Application processes, databases, queues, caches, admin panels, metrics dashboards, staging environments, test clusters, and internal services aren't built to be reached from the internet.

***

## How

Enforce the boundary with a VPN, a private cloud network, or a managed mesh service. Then harden what remains reachable:

* Use TLS for all external traffic, and authenticated TLS between your own services. See [Encrypt with TLS](https://shopify.dev/docs/apps/build/security/app-store-requirements#encrypt-with-tls) and [Secure your network service ports](https://shopify.dev/docs/apps/build/security/app-store-requirements#secure-your-network-service-ports), which App Store review also checks.
* Serve static assets and theme bundles from object storage or a CDN rather than from the application host, and gate the deployment of those assets as carefully as you gate your code.
* Require database authentication, and give each service only the permissions it uses.
* Keep production, staging, and development fully separate. Sharing signing keys, OAuth clients, or secrets between them means that a compromise of the weakest one is a compromise of all of them.
* Encrypt data at rest, including backups, and periodically test that a restore works.
* Monitor your public ingress traffic for activity that might indicate a compromise.

***