diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4491648..a578966 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ### v3.9.x - [Unreleased]
 
+#### Added
+
+- [STACK] Nginx server_names_hash_bucket_size automated fix
+- [STACK] Nginx configuration rollback in case of failure after `wo stack upgrade --nginx
+- [STACK] Nginx ultimate bad bots blocker with `wo stack install --ngxblocker`
+
 ### v3.9.9.1 - 2019-09-26
 
 #### Added
diff --git a/wo/cli/plugins/stack_pref.py b/wo/cli/plugins/stack_pref.py
index 1fac069..4b10482 100644
--- a/wo/cli/plugins/stack_pref.py
+++ b/wo/cli/plugins/stack_pref.py
@@ -24,6 +24,7 @@ from wo.core.shellexec import CommandExecutionError, WOShellExec
 from wo.core.sslutils import SSL
 from wo.core.template import WOTemplate
 from wo.core.variables import WOVariables
+from wo.core.nginxhashbucket import hashbucket
 
 
 def pre_pref(self, apt_packages):
@@ -470,20 +471,27 @@ def post_pref(self, apt_packages, packages, upgrade=False):
                                       '> /dev/null 2>&1',
                                       comment='Cloudflare IP refresh cronjob '
                                       'added by WordOps')
-
-            if upgrade:
-                try:
-                    WOShellExec.cmd_exec(self, 'nginx -t')
-                except CommandExecutionError as e:
-                    Log.debug(self, "{0}".format(e))
-                    Log.info(self, "Rolling-Back Nginx"
-                             "configuration")
-                    WOGit.rollback(self, ["/etc/nginx"])
+                WOGit.add(self,
+                          ["/etc/nginx"], msg="Adding Nginx into Git")
 
             # Nginx Configation into GIT
             WOGit.add(self,
                       ["/etc/nginx"], msg="Adding Nginx into Git")
-            WOService.restart_service(self, 'nginx')
+            if not WOService.restart_service(self, 'nginx'):
+                try:
+                    hashbucket(self)
+                    WOService.restart_service(self, 'nginx')
+                except Exception:
+                    Log.warn(
+                        self, "increasing nginx server_names_hash_bucket_size "
+                        "do not fix the issue")
+                    Log.info(self, "Rolling back to previous configuration")
+                    WOGit.rollback(self, ["/etc/nginx"])
+                    if not WOService.restart_service(self, 'nginx'):
+                        Log.error(
+                            self, "There is an error in Nginx configuration.\n"
+                            "Use the command nginx -t to identify "
+                            "the cause of this issue", False)
 
         if set(WOVariables.wo_php).issubset(set(apt_packages)):
             WOGit.add(self, ["/etc/php"], msg="Adding PHP into Git")
diff --git a/wo/core/nginxhashbucket.py b/wo/core/nginxhashbucket.py
index 9145812..6424c5e 100644
--- a/wo/core/nginxhashbucket.py
+++ b/wo/core/nginxhashbucket.py
@@ -28,8 +28,14 @@ def hashbucket(self):
     ngx_hash = math.trunc(math.pow(2, ngx_calc))
 
     # Replace hashbucket in Nginx.conf file
-    if WOFileUtils.grep(self, "/etc/nginx/nginx.conf",
-                        "server_names_hash_bucket_size"):
+    if WOFileUtils.grepcheck(self, "/etc/nginx/nginx.conf",
+                             "# server_names_hash_bucket_size 64;"):
+        ngxconf = open("/etc/nginx/conf.d/hashbucket.conf",
+                       encoding='utf-8', mode='w')
+        ngxconf.write("\tserver_names_hash_bucket_size {0};".format(ngx_hash))
+        ngxconf.close()
+    elif WOFileUtils.grepcheck(self, "/etc/nginx/nginx/conf",
+                               "server_names_hash_bucket_size"):
         for line in fileinput.FileInput("/etc/nginx/nginx.conf", inplace=1):
             if "server_names_hash_bucket_size" in line:
                 print("\tserver_names_hash_bucket_size {0};".format(ngx_hash))
@@ -37,8 +43,7 @@ def hashbucket(self):
                 print(line, end='')
 
     else:
-        WOFileUtils.searchreplace(self, '/etc/nginx/nginx.conf',
-                                  "gzip_disable \"msie6\";",
-                                  "gzip_disable \"msie6\";\n"
-                                  "\tserver_names_hash_bucket_size {0};\n"
-                                  .format(ngx_hash))
+        ngxconf = open("/etc/nginx/conf.d/hashbucket.conf",
+                       encoding='utf-8', mode='w')
+        ngxconf.write("\tserver_names_hash_bucket_size {0};".format(ngx_hash))
+        ngxconf.close()