I have my Apache installed behind Nginx. So every request that comes in is first handeled by Nginx. If there is dynamic content needed the request is send to Apache which listens on port 8080.
Pretty basic reverse proxy setup.
Now with this setup the first entry point is Nginx. Is it still needed to install ModSecurity to protect Apache against unwanted request.
Or should I just focus on protecting Nginx as this is the first entry point.
All suggestions are welcome.