Is nginx needed if Express used

This is a way too open-ended question but I will try to answer it:

In terms of security could someone tell me If I need nginx, and my options please?

You will need Nginx (or Apache) on any scenario. With one server or multiple. Using Express or not. Express is only an application framework to build routes. But you still need a service that will respond to network requests. This is what Nginx and Apache do. You could avoid using Nginx but then your users would have to make the request directly to the port where you started Express. For example: http://my-site.com:3000/welcome. In terms of security you would better hide the port number and use a Nginx's reverse proxy so that your users will only need to go to http://my-site.com/welcome.

my developer tells me I should use another server to host the front-ends, such as cloudflare

Cloudflare does not offer hosting services as far as I know. It does offer CDN to host a few files but not a full site. You would need another Digial Ocean instance to do so. In a Cloudflare's forum post I found: "Cloudflare is not a host. Cloudflare’s basic service is a DNS provider, where you simply point to your existing host.".

I have read that nginX can enable hosting multiple sites on the same server

Yes, Nginx (and Apache too) can host multiple sites. With different names or the same. As domains (www.my-backend.com, www.my-frontend.com) or subdomains (www.backend.my-site.com, www.my-site.com) in the same server.

... but unsure if this is good practice

Besides if it is a good or bad practice, I think it is very common. A few valid reasons to keep them in separated servers would be:

• Because you want that if the front-end fails the back-end API continues to work.
• Because you want to balance network traffic.
• Because you want to keep them separated.

It is definitively not a bad practice if both applications are highly related.