diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
deleted file mode 100644
index 31d94245c..000000000
--- a/docker-compose.prod.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-version: "3.7"
-
-networks:
-  # https://github.com/collinbarrett/wp-host-on-containers/blob/master/docker-compose.nginx.yml
-  reverse-proxy:
-    external:
-      name: wp-host_reverse-proxy
-      
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 378826bc3..7c4f3f234 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,6 +6,7 @@ services:
     restart: always
     ports:
       - "80:80"
+      - "443:443"
     networks:
       - reverse-proxy
     depends_on:
diff --git a/ops/nginx/conf.d/filterlists.conf b/ops/nginx/conf.d/filterlists.conf
index 4a92743d3..9bc5af745 100644
--- a/ops/nginx/conf.d/filterlists.conf
+++ b/ops/nginx/conf.d/filterlists.conf
@@ -1,5 +1,13 @@
+# https://github.com/collinbarrett/FilterLists
 server {
   listen 80 default_server;
+  listen 443 default_server ssl http2;
+  server_name filterlists.com;
+
+  include svr-includes/*;
+  
+  ssl_certificate /etc/nginx/cert/filterlists_cert.pem;
+  ssl_certificate_key /etc/nginx/cert/filterlists_key.pem;
 
   location ^~ /api {
     rewrite ^/api/(.*)$ /$1 break;
@@ -23,4 +31,16 @@ server {
     proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header   X-Forwarded-Proto $scheme;
   }
-}
\ No newline at end of file
+}
+
+# Redirect www to non-www
+server {
+  listen 80;
+  listen 443 ssl http2;
+  server_name www.filterlists.com;
+
+  ssl_certificate /etc/nginx/cert/filterlists_cert.pem;
+  ssl_certificate_key /etc/nginx/cert/filterlists_key.pem;
+
+  return 301 https://filterlists.com$request_uri;
+}
diff --git a/ops/nginx/svr-includes/security.conf b/ops/nginx/svr-includes/security.conf
new file mode 100644
index 000000000..a53c73a47
--- /dev/null
+++ b/ops/nginx/svr-includes/security.conf
@@ -0,0 +1,6 @@
+server_tokens off;
+
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-Frame-Options "SAMEORIGIN" always;
+add_header X-XSS-Protection "1; mode=block" always;
+add_header Referrer-Policy "no-referrer" always;
diff --git a/ops/nginx/svr-includes/ssl.conf b/ops/nginx/svr-includes/ssl.conf
new file mode 100644
index 000000000..4cfb00994
--- /dev/null
+++ b/ops/nginx/svr-includes/ssl.conf
@@ -0,0 +1,18 @@
+# https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=nginx-1.15.9&openssl=1.0.1e&hsts=yes&profile=modern
+
+ssl_session_timeout 1d;
+ssl_session_cache shared:SSL:50m;
+ssl_session_tickets off;
+
+ssl_protocols TLSv1.2;
+ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+ssl_prefer_server_ciphers on;
+
+ssl_dhparam /etc/nginx/cert/dhparam.pem;
+
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+
+# https://support.cloudflare.com/hc/en-us/articles/204899617-Authenticated-Origin-Pulls
+
+ssl_client_certificate /etc/nginx/cert/cloudflare.crt;
+ssl_verify_client on;