iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The safest Compose layout is a single public-facing WAF container in front of Nginx. Nginx, PHP-FPM WordPress, and the database share only an internal Docker network, so they are not directly reachable from the internet. The WAF uses its BACKEND setting to proxy HTTP requests to the Nginx service. Start with ModSecurity in detection-only mode, tune false positives against normal WordPress traffic, and enable blocking only after the logs are clean.
How the request path should work
A browser should reach one published port and one service:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- The client connects to the WAF, which terminates TLS if you configure it to do so and applies ModSecurity with the OWASP Core Rule Set (CRS).
- The WAF forwards an allowed HTTP request to the Compose service named by
BACKEND. - Nginx serves static files and sends PHP requests to WordPress PHP-FPM over the internal network.
- WordPress connects to the database over that same private network.
Do not point the WAF directly at a PHP-FPM port. PHP-FPM speaks FastCGI, not HTTP; the WAF needs an HTTP web server such as Nginx as its upstream.
| Component | Role | Internet exposure |
|---|---|---|
| WAF | ModSecurity and OWASP CRS; reverse proxy | Only service with a published host port |
| Nginx | HTTP server, static files, FastCGI gateway | Internal network only |
| WordPress PHP-FPM | Executes WordPress PHP code | Internal network only |
| MariaDB (or another supported database) | Stores WordPress data | Internal network only |
The CRS project publishes official ModSecurity Docker and Core Rule Set images in its modsecurity-crs-docker repository. Image tags and wrapper variables change, so check the current repository documentation before choosing a tag. In particular, an nginx-alpine tag seen in examples is not confirmation that the tag is currently published.
#1 Best Overall
- WHY CHOOSE G3 ULTRA MINI PC PENTIUM GOLD 7505 - Choose the Intel Pentium Gold 7505 for snappier everyday responsiveness: It delivers up to 30% faster single-core performance than the Ryzen 5 3500U, making office apps and web browsing feel noticeably quicker, while its Intel UHD Graphics (48 EUs) provides 2.4x the GPU performance of the N100 & N150's 24-EU graphics, ensuring smoother 4K streaming and light photo editing.
- 16GB RAM MEMORY & 512GB STORAGE - GMKtec Nucbox G3 Ultra mini computer is prebuilt with 16GB LPDDR4 RAM at 3200 MT/s, you will enjoy a speedier experience with Built-in 512GB M.2 SATA Hard Drive. Our mini desktop pc boots up in seconds, work on multiple browser tabs, software applications and quickly transfers files. There is a primary slot and secondary expansion storage. Primary slot is M.2 2280 PCIE and secondary slot is M.2 2280 SATA.
- RICH INTERFACE - Nucbox pentium mini computer is equipped with 3* USB 3.2 Gen2 ports, up to 10Gbps/S, 1*USB 2.0, HDMI(4K@60Hz)*2, 3.5mm Audio Jack. Supports WiFi 6, and Gigabit Ethernet RJ45 2.5GbE network connectivity, Bluetooth 5.2. This Mini PC supports multiple device connection and can be used with servers, monitoring equipment, office equipment, displays, projectors, televisions, etc.
- 4K DUAL SCREEN DISPLAY - Mini desktop computer is equipped with upgraded Intel Graphics(max 1000MHz), supports 4K video playback and AV1 decoding, connect the pc with a projector as a home theatre, enjoy a variety of entertainments. Two HDMI 2.0 ports allows you to multi-task efficiently on two 4K@60Hz displays.
- UPGRADED COOLING FAN - The G3 Ultra has upgraded the cooling fan to reduce fan noise and thermals. We are using an upgraded thermal paste as well to help reduce heat on the CPU.
Prerequisites and project layout
- Docker Engine with the Compose v2 plugin (
docker compose). - A DNS name pointing to the host if the site will be public.
- A persistent volume or external storage plan for WordPress files and the database.
- A TLS certificate and private key if HTTPS terminates in the WAF.
- Separate, strong database and WordPress administrator credentials. Keep them in an uncommitted
.envfile or a secrets manager.
A small project can use this layout:
wordpress-waf/
├── compose.yaml
├── .env
└── nginx/
└── default.confThe example below is deliberately annotated. It demonstrates the network boundaries and variable relationships; pin image tags or digests to versions that are available when you deploy.
A Compose stack with WAF, Nginx, WordPress and a database
services:
waf:
# Verify the current image name and tag in the CRS repository.
image: owasp/modsecurity-crs:nginx-alpine
ports:
- "8080:8080"
environment:
PORT: "8080"
# Use the HTTP service, not the PHP-FPM service.
BACKEND: "http://nginx:80"
# CRS v4 variable names:
BLOCKING_PARANOIA: "1"
DETECTION_PARANOIA: "2"
# Set the image's documented ModSecurity engine variable to
# DetectionOnly during initial tuning; variable names differ by image release.
depends_on:
- nginx
networks:
- public
- internal
nginx:
image: nginx:alpine
expose:
- "80"
volumes:
- wp_data:/var/www/html
- ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
depends_on:
- wordpress
networks:
- internal
wordpress:
image: wordpress:php8.3-fpm
environment:
WORDPRESS_DB_HOST: db:3306
WORDPRESS_DB_NAME: ${WORDPRESS_DB_NAME}
WORDPRESS_DB_USER: ${WORDPRESS_DB_USER}
WORDPRESS_DB_PASSWORD: ${WORDPRESS_DB_PASSWORD}
volumes:
- wp_data:/var/www/html
depends_on:
- db
networks:
- internal
db:
image: mariadb:11
environment:
MARIADB_DATABASE: ${WORDPRESS_DB_NAME}
MARIADB_USER: ${WORDPRESS_DB_USER}
MARIADB_PASSWORD: ${WORDPRESS_DB_PASSWORD}
MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
volumes:
- db_data:/var/lib/mysql
networks:
- internal
networks:
public: {}
internal:
internal: true
volumes:
wp_data:
db_data:Important details:
BACKENDcontains the Compose DNS name and port of the HTTP upstream. In this three-tier layout that ishttp://nginx:80. If you combine Nginx and WordPress into one HTTP container, use that service name instead.- Only
wafhas aportsmapping.exposeon Nginx documents an internal port; it does not publish it on the host. - The shared
wp_datavolume lets Nginx read WordPress static files while PHP-FPM writes the application files. - The
internalnetwork prevents ordinary external connections to its services. It can also prevent WordPress from reaching external update servers. If outbound updates are required, provide controlled egress rather than publishing WordPress or the database. - The PHP-FPM image and database image are examples, not a promise that every future tag will remain available. Select currently supported tags and pin them after testing.
Configure Nginx to serve WordPress and PHP-FPM
Create nginx/default.conf:
server {
listen 80;
server_name _;
root /var/www/html;
index index.php index.html;
client_max_body_size 64m;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTP_PROXY "";
fastcgi_pass wordpress:9000;
}
location ~* /. {
deny all;
}
}The fastcgi_pass target uses the WordPress service name and the PHP-FPM port. The WAF never talks to that port. The hidden-file rule blocks accidental exposure of files such as environment or version-control metadata; review it if a legitimate application path needs an exception.
Store credentials outside the Compose file
For local development, create .env with restrictive file permissions:
WORDPRESS_DB_NAME=wordpress
WORDPRESS_DB_USER=wpuser
WORDPRESS_DB_PASSWORD=replace-with-a-long-random-value
MARIADB_ROOT_PASSWORD=replace-with-a-different-long-random-valueAdd .env to version-control ignore rules. For production, Docker secrets or an external secret manager are preferable because Compose environment values can be revealed through inspection and process diagnostics. Back up the database and the wp_data volume independently; a database backup alone does not preserve uploaded media or plugins.
Rank #2
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
Start in detection mode, then enable blocking
CRS rules can legitimately flag unusual administrator requests, block-editor payloads, plugin updates, REST requests, or XML-RPC traffic. A clean home page is not enough to validate a WordPress deployment.
- Confirm the WAF image’s current configuration variable for ModSecurity’s rule engine and set it to
DetectionOnly. Image wrappers have used different names, so use the variable documented for the exact tag you selected. - Bring the stack up and watch startup output:
docker compose config
docker compose up -d
docker compose ps
docker compose logs -f waf- Open the site through the published WAF address, for example
http://localhost:8080, and exercise normal workflows: WordPress setup, login, media upload, the block editor, plugin and theme screens, REST API calls, and scheduled tasks. - Record the rule ID, request path, authenticated user context, and payload for each false positive. Do not respond by disabling an entire CRS rule group.
- Add narrow exclusions for the affected path and rule ID using the image’s documented exclusion mechanism. Keep administrator paths and XML-RPC exceptions as specific as possible, and review them after plugin changes.
- Repeat the normal workflow and confirm that the exclusion does not make unrelated paths permissive.
- Change the rule engine to blocking (often called
Onin ModSecurity), restart the WAF, and retest. KeepBLOCKING_PARANOIAat a conservative baseline while you establish normal traffic.
In CRS version 4, the blocking setting is named BLOCKING_PARANOIA; older examples using PARANOIA are not interchangeable. DETECTION_PARANOIA lets you evaluate a higher paranoia level without enforcing it, so a common staged approach is blocking level 1 with detection level 2, followed by targeted tuning before raising the blocking level.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Test the proxy and the rules
First verify that an ordinary request traverses the WAF:
curl -i http://localhost:8080/
curl -i http://localhost:8080/wp-login.phpThen send a harmless test string that commonly triggers an injection or scripting rule. Use a disposable test environment and URL-encode the value:
Rank #3
- ➊ [ Trusted Quality for Everyday Agentic AI ] GEEKOM equips its SSDs with reliable original-grade flash and conducts rigorous stability testing to support dependable everyday operation. This commitment to quality is backed by a 3-year warranty. Simply connect the Air12 to cloud AI services for research, writing, study support and daily productivity—no NPU or complex local setup required. Designed for students, home users, light office work and first-time buyers, the Air12 is a high-value Cloud Agentic PC for everyday tasks
- ➋ [ Intel 7505 processor ] Powered by the Intel 7505 processor (2 cores, 4 threads, up to 3.5GHz), the GEEKOM Mini PC Air12 delivers smooth performance for everyday computing, office tasks, and home entertainment. With enhanced single-core processing, it handles daily workloads efficiently and responsively. Compact, quiet, and energy-efficient — a solid alternative to bulky desktops.
- ➌ [440lbs(200kg) Pressure Rated Metal Frame for Demanding Environments] Unlike the Plastic Shells You’ll Find on Most Mini PCs, geekom Mini Air12 features a triple-reinforced ABS+PC shell, precision-crafted metal frame and baseplate—engineered to withstand up to 440 lbs of pressure for the perfect balance of strength and thermal efficiency. Tool-free upgrades, shock-absorbing feet, and a 3D antenna deliver true durability
- ➍ [Dual-Channel RAM & NVMe SSD Expandability] Ships with 8GB DDR4 RAM and a 256GB NVMe SSD for smooth everyday performance. Dual memory slots and dual storage slots give you the flexibility to upgrade to 64GB RAM and 2TB SSD, so your system can adapt as your workload grows. Enjoy faster load times, smoother multitasking, and long-term reliability.
- ➎ [Triple 4K Displays for Maximum Productivity] Connect up to three 4K monitors via HDMI 2.0, Mini DisplayPort 1.4, and USB-C — ideal for stock trading dashboards, multi-tab research, office document editing, and light spreadsheet work. WiFi 6 and Bluetooth with high-gain antenna ensure stable wireless connections throughout your workspace. 5x USB ports and a full-size SD card reader provide quick access to peripherals and camera files — no adapters required.
curl -i "http://localhost:8080/?q=%3Cscript%3Etest%3C%2Fscript%3E"
docker compose logs --since=10m wafIn detection-only mode, the request may receive a normal response while the audit or error log records a rule match. In blocking mode, a matching request may return a 403 response. A 403 proves only that a rule matched; inspect the rule ID and transaction details before deciding whether it is malicious or a false positive. Never use production customer data for payload testing.
Preserve client information through the proxy
Applications and security logs need the original client address, not only the WAF container’s address. Configure the WAF to pass standard X-Forwarded-For, X-Forwarded-Proto, and Host headers according to the image documentation, and configure Nginx and WordPress to trust those headers only from the WAF’s internal address range. Blindly trusting headers from every client lets an attacker forge IP-based controls and audit records.
If TLS terminates at the WAF, forward X-Forwarded-Proto: https and configure WordPress’s canonical URL and secure-cookie behavior consistently. If TLS terminates at an external load balancer, restrict the WAF’s published port to that load balancer and apply the same trusted-proxy rules.
Tune WordPress false positives without weakening the whole CRS
WordPress has several request classes that differ from a typical brochure site:
Rank #4
- 【AMD Ryzen 4300U True 4-Core CPU: Outperforms N95 & i3-10110U】KAMRUI P2 Mini PC is equipped with true 4-core AMD Ryzen 4300U processor built on advanced 7nm Zen2 architecture，This means you get consistent, unthrottled performance for hours on end, whether you’re running multiple browser tabs, streaming 4K content, or managing virtual machines. Compare that to Intel N95 (4 efficiency cores that throttle under load) or Intel i3-10110U (only 2 cores total), and the difference is night and day: The KAMRUI P2 AMD Ryzen 4300U (28W) is 40% faster than the Intel i3-10110U and 25% faster than the Intel N95 in multi-core tasks, ensuring smooth, lag-free performance even during heavy workloads.
- 【Integrated AMD Radeon Graphics: 2.5X Stronger for Tri 4K】The KAMRUI P2 AMD 4300U Mini PC have unlocked the full potential of the built-in AMD Radeon Vega 5 graphics with 28W power delivery, making it 2.5 times stronger than the Intel UHD graphics found in the N95 and i3-10110U. This means you can enjoy Tri 4K@60Hz displays without a single stutter, perfect for productivity setups, home theaters, or even light photo/video editing and casual gaming. While the Intel N95/i3-10110U struggle to run a single 4K display without lag, The KAMRUI AMD 4300U Mini PC handles Tri 4K effortlessly, turning your workspace into a high-efficiency hub or your living room into a premium entertainment center.
- 【Large Storage Capacity, Easy Expansion】KAMRUI Pinova P2 mini computers is equipped with 16GB LPDDR4 for faster multitasking and smooth application switching. 512GB M.2 SSD ensures fast startup, fast file transfers and plenty of storage space,eliminating slow loading times and ensuring fast responsiveness. the two storage slots (1x M.2 2280 SATA/NVMe PCIe3.0 slot, 1x M.2 2280 SATA slot) can be combined to provide up to 4TB of total storage(Not included). This gives you enough space for all your projects, media and data.
- 【4K Triple Display】KAMRUI Pinova P2 4300U mini desktop computers is equipped with HDMI2.0 ×1 +DP1.4 ×1+USB3.2 Gen2 Type-C ×1 interfaces for faster transmission, Triple 4K@60Hz Display, KAMRUI P2 mini computer is ideal for visual home entertainment, home office, conference rooms, etc. USB3.2 Gen2 Type-A port ×2 with a transfer speed of up to 10 Gbps (21 times faster than USB 2.0) for efficient data transfer. Ideal for seamless multitasking between spreadsheets, browsers and presentations, or for an immersive entertainment experience.
- 【USB3.2 Gen2 Type-C 10Gbps, Versatile connectivity】KAMRUI P2 mini desktop pc fast and versatile connectivity! The USB3.2 Gen2 Type-C port offers a data transfer rate of 10Gbps and simultaneously supports DisplayPort 1.4 video output. The P2 AMD Ryzen 4300U Mini PC is complemented by Gigabit LAN, WiFi and Bluetooth, so nothing stands in the way of a productive working environment.
/wp-admin/and/wp-admin/admin-ajax.phpcarry complex form and serialized data./wp-json/and block-editor requests contain JSON, HTML fragments, and user-generated content.- Plugin and theme updates may upload archives or send code-like strings.
/xmlrpc.phpcan be required by specific integrations but is frequently attacked; disable it when you do not need it, or protect it with a narrowly scoped policy.
For every exception, document why the path is needed, the exact CRS rule ID, who approved it, and when it should be reviewed. Prefer a rule exclusion for one parameter or endpoint over a global exclusion. Keep the WAF in detection mode while installing or updating plugins, because a new plugin can introduce request patterns that were not present during the first tuning pass.
Versioning and upgrades
Do not copy a CRS version number from an old blog post. Conflicting reports have mentioned different 4.x releases, and those numbers were not verified against the official release page. Check the official CRS Docker repository and release information immediately before deployment, select a tested tag, and pin that tag or an immutable digest in Compose. Record the chosen image versions with your infrastructure code.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Upgrade in a staging project first. Export the current WAF configuration and exclusions, run the WordPress workflow matrix, inspect new detections, and only then promote the image. Keep the previous image available for rollback. Database and WordPress core upgrades should likewise be tested with the WAF enabled; a stack that works only when the WAF is bypassed is not ready for production.
Quick Recap
Troubleshoot by symptom
| Symptom | Likely cause | Checks and remedy |
|---|---|---|
| WAF returns a gateway or connection error | Wrong BACKEND name, wrong port, or Nginx is not ready |
Run docker compose ps; from the WAF container, resolve nginx; verify Nginx listens on port 80 and that both services share internal. |
| Nginx serves 502 for PHP requests | PHP-FPM service name or port is wrong | Check fastcgi_pass wordpress:9000, inspect WordPress container logs, and confirm the two containers share the wp_data volume. |
| WordPress installer cannot reach the database | Incorrect database host or credentials | Use db:3306, match the four database variables, and wait for the database’s first initialization to finish. |
| Static files return 404 | Nginx and PHP-FPM do not see the same document root | Mount the same wp_data volume at /var/www/html in both services. |
| Legitimate admin action is blocked | CRS false positive | Use the logged rule ID to create a narrow path or parameter exclusion; do not disable CRS globally. |
| WordPress cannot install updates | The internal network has no outbound route | Provide controlled egress or a maintenance-only network path; never publish the PHP-FPM or database ports as a shortcut. |
Production checklist
- Publish only the WAF port; verify no accidental host mappings exist for Nginx, PHP-FPM, or the database.
- Use HTTPS, redirect plain HTTP where appropriate, and protect private keys with restrictive permissions.
- Pin and periodically update the WAF, CRS, Nginx, PHP, WordPress, and database images.
- Keep database credentials out of source control and rotate them on a schedule.
- Back up both database contents and the WordPress files volume; test restoration.
- Monitor WAF audit logs, Nginx access logs, PHP errors, and database health with synchronized timestamps.
- Limit administrator accounts, require strong authentication, remove unused plugins, and disable XML-RPC when no integration needs it.
- Re-test login, media uploads, REST requests, scheduled jobs, and plugin updates after every WAF or WordPress change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
