How my websites stay up and stay safe

One rented server, eight websites, and the layers that stand between them and the internet.

Conner McCarthy, October 2026

Press the right arrow key or swipe to begin.

Eight sites live on one server

A Linux machine rented from Amazon Web Services. The kind of site decides how much there is to protect.

Folders of files

  • physics
  • sun
  • chess
  • oort
  • slides

The server hands out HTML, CSS and JavaScript exactly as they are. Nothing runs on the server, so there's no program to trick.

Running apps

  • connermccarthy.com
  • ai
  • brief

Node.js programs kept alive by PM2, which restarts them if they crash. They do real work, like forms, AI chat and email, so they need more care.

Follow one visit

Here's what happens between typing an address and seeing the page. The rest of the talk takes these stops one at a time.

  1. Your browser

    You type physics.connermccarthy.com and press Enter.

  2. DNS

    The internet's address book turns the name into the server's address.

  3. Firewall

    The server checks which door you knocked on, and drops you if it's closed.

  4. Nginx

    The front desk sets up encryption, reads the name and finds the right site.

  5. The site

    A folder of files or a running app answers, and the page comes back the same way.

The address book is public on purpose

connermccarthy.com
ai.connermccarthy.com
physics.connermccarthy.com
slides.connermccarthy.com
and the rest

one server

Anyone can look up which address a name points to. That's how the internet finds anything, so DNS isn't a place to hide secrets.

The real danger is someone taking over the account at the domain registrar and pointing the names somewhere else. That login deserves the strongest password and two-step sign-in you have.

Three doors open out of 65,535

A server has 65,535 numbered doors, called ports, that traffic can knock on. The firewall drops every knock except on three.

  • Web, for plain http:// visits that get redirected straight to the encrypted door
  • Encrypted web, for https://
  • The admin door, which only I use
  • Closed: each grey tile is 256 doors that ignore every knock

The admin door only opens with a key

No passwords

Logging in takes a key file that never leaves my computer. There's no password to guess, so guessing is pointless.

No root

Nobody can log in directly as root, the all-powerful account. I log in as a normal user and ask for power when I need it.

Fail2ban

If an address keeps failing to log in, Fail2ban bans it automatically.

19 logins in the last five weeks, every one with a key, and 0 failed attempts.

Nginx is the front desk

It's the only program that talks to the internet. It reads which name you asked for and sends you to that site.

It encrypts

Every site has a free Let's Encrypt certificate. The server checks twice a day and renews them before they expire.

It insists

Plain http:// gets redirected to https://. Then the browser is told never to try the plain door again for a year.

It hides

Files starting with a dot, like .git history or .env secrets, get "not found" even when they're in the folder.

# Never serve dotfiles such as .git/ or .env
location ~ /\.(?!well-known) {
  return 404;
}

The rules this page came with

Nginx sends instructions called headers with every page. This deck just asked the server for them.

Strict-Transport-Security
Only ever use https:// for this site.
Content-Security-Policy
Only run scripts and styles that come from this site's own files.
X-Content-Type-Options
Don't guess what a file is; trust the label.
Referrer-Policy
When leaving, tell the next site only which domain you came from.
Permissions-Policy
This page never gets the camera, microphone or location.

Checking the server…

This slide has an inline script that tries to replace this sentence. The content policy blocked it, so you're still reading the original.

The apps sit behind the desk, not at the door

Internet
Nginx
3 running appstheir doors stay shut to the outside
5 folders of filesnothing to run
Secretskept outside every web folder

The firewall keeps the apps' own doors closed, so the internet can't talk to them directly. Every request goes through Nginx first. API keys and passwords live in files no web address points to.

What runs while I sleep

Chores the server does on its own every day, in server time (UTC).

  1. Certificates checked

    Twice a day, renewed if they're close to expiring.

  2. Security updates

    Patches are downloaded and installed automatically.

  3. Rootkit scan

    Rkhunter looks for signs of tampering and emails me a summary.

  4. Traffic report

    An email with visitor counts and server status.

The small ticks are a disk check every 15 minutes. It emails me if any disk gets more than 85% full.

Layers, not one lock

  1. DNS

    A well-protected registrar login

  2. Firewall

    Three doors open, everything else ignored

  3. Admin door

    Keys only, no root, repeat offenders banned

  4. Nginx

    Encryption everywhere, hidden files, strict headers

  5. The sites

    Apps behind the desk, secrets out of reach

  6. Night watch

    Updates, scans and alerts every day

If one layer fails, the next one is still standing. Questions?