Rename upstream server
Better nginx configuration
Harden SSL settings
Ignore invalid headers to allow CSRF protection
Better proxy settings