🔧 NGINX Server Configuration Guide

📋 Managing NGINX Logs

NGINX logs are essential for monitoring server activity, debugging issues, and analyzing traffic patterns. Log files provide detailed information about requests, errors, and server performance.

Accessing Log Files

Navigate to the NGINX log directory:

List all log files:

View a specific log file:

View logs with pagination (recommended for large files):

⚙️ PHP-FPM Pool Configuration

PHP-FPM (FastCGI Process Manager) pools allow you to run multiple PHP applications with different configurations, users, and resource limits. This provides better isolation and security for multi-site hosting environments.

Creating a System User

First, create a dedicated user for the website:

User Group Configuration

Add users to appropriate groups for proper permissions:

Creating a New Pool Configuration

Navigate to the PHP-FPM pool directory:

List existing pool configurations:

Copy the default pool configuration as a template:

Edit the new pool configuration:

Essential Pool Configuration Parameters

Creating the PHP-FPM Log File

Create the log file:

Set proper ownership:

Set appropriate permissions:

Verifying Socket Configuration

Verify the socket path in your pool configuration:

Updating NGINX Configuration

Edit your NGINX site configuration:

Update the fastcgi_pass directive to use your new socket:

Testing and Applying Changes

Test NGINX configuration:

Reload PHP-FPM and NGINX:

Advanced PHP Configuration

Enabling URL File Operations

Disabling Dangerous Functions

For security, disable potentially dangerous PHP functions:

Configuring Temporary Directories

Create and configure the temporary directory:

Restricting File Access with open_basedir

Limit PHP file access to specific directories:

🔒 SSL/TLS Certificate Configuration

SSL/TLS certificates encrypt data transmitted between your server and clients, providing security and trust. Modern web browsers require HTTPS for many features and rank HTTPS sites higher in search results.

Installing Certbot

Update package lists:

Install Certbot with Cloudflare DNS plugin:

Obtaining SSL Certificates

Request a certificate using webroot validation:

Generating Diffie-Hellman Parameters

Create SSL directory:

Generate DH parameters (this may take several minutes):

Creating SSL Configuration Files

Site-Specific SSL Configuration

Create a configuration file for your site's certificates:

Global SSL Configuration

Create a global SSL configuration for all sites:

Configuring NGINX Server Blocks for HTTPS

HTTP to HTTPS Redirect

HTTPS Server Block (Primary Site)

Additional HTTPS Server Blocks

For additional sites, omit the reuseport parameter:

Adding HTTP_HOST Parameter

In your PHP processing block, add:

Testing HTTP/3 Configuration

Add this directive temporarily to prevent browser caching:

Testing Configuration

Test NGINX syntax:

Reload NGINX:

Test with curl commands:

SSL Testing Resources

• SSL Labs: Test your SSL configuration at ssllabs.com (expect A+ rating)
• HTTP/3 Check: Verify HTTP/3 support at http3check.net
• Browser DevTools: Open Network tab, right-click on column headers, enable "Protocol" column to see "h3" for HTTP/3 connections

Certificate Management Commands

Automated Certificate Renewal

Edit the root crontab:

Add these lines to renew certificates twice monthly:

🛡️ HTTP Security Headers

HTTP response headers are a crucial component of web security. They provide the browser with instructions on how to handle content, control security policies, and protect against various types of attacks. These headers are sent by the server in response to HTTP requests made by clients (typically web browsers).

Understanding HTTP Header Types

HTTP headers contain metadata about connections, requested resources, and returned resources. There are several types of headers:

• General Headers: Apply to both requests and responses
• Request Headers: Sent by the client to the server
• Response Headers: Sent by the server to the client
• Entity Headers: Describe the content body

Essential Security Headers

1. X-XSS-Protection

This header configures the XSS (Cross-Site Scripting) auditor built into older browsers. When an XSS attack is detected, the browser can block the page or sanitize it.

2. X-Frame-Options

Controls whether your site can be embedded in frames or iframes. This prevents clickjacking attacks where malicious sites trick users into clicking on concealed elements.

3. X-Content-Type-Options

Prevents browsers from MIME-sniffing a response away from the declared content-type. This stops browsers from trying to interpret files as a different MIME type than what's specified.

The only valid value is nosniff, which forces browsers to respect the declared Content-Type.

4. Referrer-Policy

Controls how much referrer information is sent when navigating from your site to other sites. This is crucial for privacy and may affect analytics or affiliate tracking.

5. Permissions-Policy (formerly Feature-Policy)

Controls which browser features and APIs can be used in your site and in embedded iframes. This provides granular control over powerful browser capabilities.

Common Directives:

• accelerometer - Control access to device accelerometer
• camera - Control access to device camera
• geolocation - Control access to GPS/location
• microphone - Control access to device microphone
• payment - Control Payment Request API
• usb - Control WebUSB API
• fullscreen - Control fullscreen capability

6. Content-Security-Policy (CSP)

The most powerful security header, CSP helps protect against Cross-Site Scripting (XSS), data injection attacks, and other code injection vulnerabilities. It defines trusted sources for content loading and execution.

Key Benefits:

• Prevents execution of malicious scripts
• Blocks unauthorized resource loading
• Mitigates XSS and data injection attacks
• Provides detailed violation reporting

Implementing Security Headers in NGINX

Navigate to the NGINX includes directory:

Create the HTTP headers configuration file:

Add the following security headers:

Including Headers in Site Configuration

Navigate to sites-available directory:

Edit your site configuration:

Add the include directive above your PHP processing block:

Verifying Headers

Test NGINX configuration:

Reload NGINX:

Check headers with curl:

Enhanced Browser Caching with Security Headers

Create an updated browser caching configuration:

This configuration:

• Sets 30-day cache expiration
• Enables ETags for cache validation
• Uses exact if-modified-since checking
• Includes security headers for cached resources
• Disables access logging for static assets

🔐 WordPress-Specific Security Configuration

WordPress requires specific security measures to prevent unauthorized access and code execution. NGINX provides powerful tools to harden WordPress installations against common attacks.

Creating the Security Directives File

Navigate to includes directory:

Create the security directives file:

Add comprehensive WordPress security rules:

Including Security Rules in Site Configuration

Edit your site configuration:

Add above your PHP processing block:

Allowing Specific Plugin PHP Execution

Some plugins require PHP execution. By default, we block all PHP in the plugins directory. To allow specific files:

Testing PHP Execution Block

Create a test PHP file:

Add this content:

Access via browser: https://example.com/wp-content/plugins/test556.php

Result: NGINX returns 403 Forbidden (PHP execution blocked)

Allowing Specific Plugin Files

If a plugin needs PHP execution, add a specific location block after your main PHP processing block:

Test and reload:

Cleanup

Remove the test file:

Disabling WordPress File Modifications

Add this to wp-config.php to prevent plugin/theme installation via admin panel:

After adding, reload PHP-FPM:

📁 File Ownership and Permissions

Proper file permissions are critical for WordPress security. Too permissive settings allow unauthorized modifications, while too restrictive settings break functionality. We'll cover both standard and hardened configurations.

Standard Permission Configuration

Standard permissions allow WordPress to update itself and manage uploads while maintaining reasonable security.

Navigate to your site directory:

Set ownership to your site user:

Set directory permissions (770 = rwxrwx---):

Set file permissions (660 = rw-rw----):

Secure wp-config.php (400 = r--------):

Hardened Permission Configuration

Hardened permissions prevent WordPress from modifying core files while allowing uploads and content management. This significantly improves security but requires manual updates.

Set ownership:

Set read-only directory permissions (550 = r-xr-x---):

Set read-only file permissions (440 = r--r-----):

Set writable permissions for wp-content (uploads, cache, etc.):

Permission Breakdown

Verifying Permissions

Check current permissions:

Check specific file permissions:

When to Use Each Configuration

• Standard Permissions:
  • Development environments
  • Sites requiring automatic updates
  • Sites managed by non-technical users
  • Trusted single-user environments
• Hardened Permissions:
  • Production servers
  • High-value or high-traffic sites
  • Multi-tenant hosting environments
  • Sites handling sensitive data
  • When paired with professional security monitoring

⏱️ Rate Limiting Configuration

Rate limiting protects your WordPress site from brute force attacks, particularly on wp-login.php and xmlrpc.php. By restricting the number of requests from a single IP address, you can significantly reduce the effectiveness of automated attacks.

Understanding Rate Limit Zones

Rate limit zones define how requests are tracked and limited. They're defined globally in nginx.conf and applied to specific locations.

Configuring Global Rate Limit Zone

Edit the main NGINX configuration:

Add the rate limit zone in the http block:

Creating Site-Specific Rate Limiting

Create a rate limiting configuration file:

Add rate limiting for WordPress login and XML-RPC:

Including Rate Limiting in Site Configuration

Edit your site's NGINX configuration:

Include the rate limiting configuration:

Testing and Applying Configuration

Test NGINX configuration:

Reload NGINX:

Understanding Rate Limit Behavior

Example Scenario:

• Zone configured: 30 requests/minute with burst=20
• Average rate: 1 request every 2 seconds (30/60 = 0.5 req/sec)
• Burst allows up to 20 additional requests immediately
• After burst is exhausted, requests are limited to 0.5/sec
• Exceeded requests return status code 444 (connection closed)

Monitoring Rate Limiting

Check NGINX error logs for rate limit violations:

Typical rate limit log entry:

Adjusting Rate Limits

If legitimate users are being blocked, you can adjust the limits:

Whitelisting Trusted IPs

To exempt specific IPs from rate limiting:

Additional Rate Limiting Targets

Consider applying rate limiting to these endpoints as well:

• /wp-cron.php - Prevent cron exhaustion
• /wp-json/ - Protect REST API endpoints
• /wp-comments-post.php - Prevent comment spam
• Custom admin AJAX endpoints

💾 Database Security and Privileges

WordPress database security is often overlooked but crucial. By limiting database privileges, you can reduce the potential damage from SQL injection attacks and compromised WordPress installations.

Principle of Least Privilege

WordPress typically doesn't need full database privileges. Most operations only require SELECT, INSERT, UPDATE, and DELETE. Administrative operations like CREATE TABLE and ALTER TABLE are only needed during plugin installations or updates.

Revoking All Privileges

First, remove all existing privileges from your WordPress database user:

Granting Minimal Required Privileges

Grant only the essential privileges for normal WordPress operation:

Granting Additional Privileges When Needed

When installing plugins or updating WordPress, temporarily grant additional privileges:

After completing the installation or update, revoke these privileges:

Applying Changes

After modifying privileges, flush the privilege tables:

Database Privilege Reference

Automation Script for Privilege Management

Create a script to easily toggle privileges during maintenance:

🧪 Testing and Verification

After implementing all security configurations, thorough testing ensures everything works correctly without breaking functionality.

NGINX Configuration Testing

This command checks for syntax errors. Always run before reloading NGINX.

Testing HTTP Headers

Verify all security headers are present:

Test specific static asset headers:

External Security Testing Tools

• SSL Labs: SSL Server Test - Comprehensive SSL/TLS analysis (aim for A+ rating)
• Security Headers: SecurityHeaders.com - Analyzes HTTP security headers (aim for A+ rating)
• HTTP/3 Test: HTTP3Check.net - Verify HTTP/3 and QUIC support
• Mozilla Observatory: Observatory - Overall security scan and recommendations

Functional Testing Checklist

• ✅ WordPress admin panel accessible
• ✅ Posts and pages display correctly
• ✅ Media uploads work (images, videos, documents)
• ✅ Plugin installation/updates (with appropriate privileges)
• ✅ Theme customization functions
• ✅ Contact forms submit properly
• ✅ Comment system works (if enabled)
• ✅ Search functionality operational
• ✅ RSS feeds accessible
• ✅ AJAX requests complete successfully

Performance Verification

Check server response times:

Create curl-format.txt:

🔍 Troubleshooting Common Issues

NGINX Configuration Errors

Issue: NGINX fails to reload after configuration change

Solution: Check error logs for specific issues:

File Permission Issues

Issue: WordPress cannot upload files or update

Solution: Verify ownership and permissions:

PHP-FPM Pool Issues

Issue: 502 Bad Gateway errors

Solution: Check PHP-FPM status and logs:

Rate Limiting False Positives

Issue: Legitimate users being blocked

Solution: Increase rate limits or add IP whitelist:

SSL Certificate Issues

Issue: Certificate verification failures

Solution: Check certificate validity and renewal:

🔧 Ongoing Maintenance

Regular Security Tasks

• Weekly:
  • Review NGINX access and error logs
  • Check for failed login attempts
  • Monitor disk space and resource usage
• Monthly:
  • Update WordPress core, themes, and plugins
  • Review and update security headers
  • Test SSL certificate renewal
  • Audit user accounts and permissions
• Quarterly:
  • Full security scan with external tools
  • Review and update firewall rules
  • Optimize database and check backups
  • Update documentation

Log Rotation

Ensure logs don't fill disk space. Configure log rotation:

Backup Strategy

Essential files and directories to backup:

• /etc/nginx/ - All NGINX configurations
• /var/www/example.com/ - Website files
• /etc/php/8.3/fpm/pool.d/ - PHP-FPM pool configs
• Database dumps (using mysqldump)
• /etc/letsencrypt/ - SSL certificates

🎯 Conclusion

This comprehensive guide has covered advanced NGINX configuration for WordPress hosting with a focus on security, performance, and maintainability. By implementing these configurations, you've created a robust, hardened environment that protects against common web attacks while maintaining excellent performance.

Key Achievements

Security Layers Implemented

1. Network Layer: SSL/TLS encryption, HTTP/3, secure ciphers
2. Application Layer: Security headers, CSP, Referrer Policy
3. WordPress Layer: File blocking, upload restrictions, disabled functions
4. Rate Limiting: Login protection, XML-RPC restrictions
5. File System: Hardened permissions, restricted access
6. Database Layer: Minimal privileges, access control

Next Steps

• Monitor logs regularly for suspicious activity
• Keep all software updated (NGINX, PHP, WordPress)
• Implement automated backups
• Consider additional security tools (fail2ban, ModSecurity)
• Set up monitoring and alerting (Prometheus, Grafana)
• Document your specific configuration customizations

Remember: Security is about layers. No single measure provides complete protection, but together, these configurations create a defense-in-depth strategy that makes your WordPress installation significantly more resistant to attacks.