iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Harden WordPress on Nginx by layering controls: run supported software, keep PHP-FPM as the only PHP execution path, block sensitive files and PHP inside uploads, enforce HTTPS, protect administrator accounts, and maintain tested backups and logs. Nginx is a good fit for WordPress, but a secure result depends on restrictive location rules and correct handling of PHP and proxy headers.
The safest way to make these changes is sequentially. Back up the current configuration, apply one control at a time, validate with nginx -t, reload during a controlled window, and test the front end, wp-admin, REST API, media uploads, cron, and any load-balancer path.
What Nginx hardening protects
A WordPress installation has several distinct attack surfaces. The web server can expose dot-files or configuration backups; a vulnerable plugin can leave executable content in a media directory; password guessing can consume resources or compromise an account; and a proxy can make WordPress misread an HTTPS request as plain HTTP. Hardening addresses each layer rather than relying on one security plugin or one Nginx rule.
- Platform exposure: old WordPress, PHP, database, operating-system, or Nginx versions may have publicly known flaws.
- Request routing: every PHP request should go to the intended PHP-FPM pool, not to an arbitrary file handler.
- File exposure: hidden files,
wp-config.php, and uploaded scripts should not be downloadable or executable. - Transport and identity: logins and administration need HTTPS, strong unique credentials, and two-step authentication.
- Recovery: independent backups, logs, and monitoring limit the impact when prevention fails.
No Nginx configuration guarantees that a site cannot be compromised. It reduces common paths and gives you evidence and recovery options when something goes wrong.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
1. Inventory the stack and update it first
Record the versions and ownership of WordPress core, PHP, the database, Nginx, the operating system, themes, and plugins. WordPress notes that vulnerability details commonly become public after fixes, so delaying updates leaves a known defect exposed.
The current WordPress requirements page recommends PHP 8.3 or newer, MariaDB 10.11 or newer or MySQL 8.0 or newer, and HTTPS. Older PHP and MySQL branches that have reached end of life should be treated as an upgrade project, not as a permanent security baseline.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Component | Current requirement or baseline | Action |
|---|---|---|
| WordPress | Current supported release | Update core, themes, and plugins from trusted sources; remove abandoned extensions. |
| PHP | PHP 8.3 or newer is recommended | Upgrade the runtime and verify plugin compatibility before switching production traffic. |
| Database | MariaDB 10.11 or newer, or MySQL 8.0 or newer | Patch the server and confirm backups restore on the target version. |
| Transport | HTTPS | Install a valid certificate and test renewal before enforcing redirects. |
| Nginx and operating system | Supported, patched releases | Apply vendor security updates and document the rollback package or image. |
Take a configuration and database backup before changing versions. Check PHP extensions required by the site, run a staging update where possible, and inspect the error log after each production change.
2. Establish a narrow Nginx-to-PHP-FPM boundary
Nginx should serve static files directly and pass only intended PHP requests to PHP-FPM. Do not use a catch-all rule that sends every requested path to PHP, and do not paste Apache .htaccess directives into an Nginx file; Nginx uses a different configuration model.
The following pattern is illustrative. Adjust the document root, PHP-FPM socket, certificate paths, and log paths to your distribution and deployment. Keep the PHP socket private and ensure its version matches the installed runtime.
http {
upstream wordpress_php {
server unix:/run/php/php8.3-fpm.sock;
}
server {
listen 443 ssl http2;
server_name example.test;
root /srv/www/example/public;
index index.php index.html;
access_log /var/log/nginx/example.access.log;
error_log /var/log/nginx/example.error.log;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTPS on;
fastcgi_pass wordpress_php;
}
}
}try_files $uri =404; prevents a request for a nonexistent script from being handed to PHP-FPM. Keep the fastcgi_param SCRIPT_FILENAME value aligned with the actual document root; a wrong path commonly produces a 404 or a 502 error.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep the document root deliberate
Point root at the directory that is intended to be public. If your deployment places wp-config.php one level above that directory, confirm that the release process preserves the arrangement and that the PHP process can read the file without making it web-accessible.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
3. Deny hidden files and executable uploads
Hidden files often contain credentials or development metadata. Deny them at the server layer, while allowing the ACME challenge directory only if your certificate automation needs it.
location ~ /.(?!well-known) {
deny all;
access_log /var/log/nginx/example.denied.log;
log_not_found off;
}
location ~* ^/wp-content/uploads/.*.php$ {
deny all;
access_log /var/log/nginx/example.denied.log;
}
location ~* ^/wp-content/files/.*.php$ {
deny all;
access_log /var/log/nginx/example.denied.log;
}The uploads rule also covers a common multisite-style files path. Add any equivalent media directory used by your installation. Uploaded images, documents, and archives should be downloadable data, never server-side code. Keep denied-request logging enabled so repeated probes can be reviewed or fed into a fail2ban-style control.
Protect the configuration file explicitly as a second line of defense:
location = /wp-config.php {
deny all;
access_log /var/log/nginx/example.denied.log;
}Also review release archives, editor backups, database dumps, and temporary files under the web root. A deny rule for dot-files does not automatically cover a plainly named .zip or .sql file.
4. Turn on HTTPS and secure administration
Run the site on a valid certificate and redirect clear-text HTTP to the HTTPS virtual host. Keep the redirect simple so health checks, canonical URLs, and certificate renewal remain predictable.
server {
listen 80;
server_name example.test;
return 301 https://$host$request_uri;
}On the TLS virtual host, set the normal WordPress routing and pass the secure scheme to PHP-FPM. In wp-config.php, force secure logins and administration:
define( 'FORCE_SSL_ADMIN', true );Test the login page, dashboard, media library, REST API, and scheduled tasks after enabling this setting. Mixed-content warnings usually indicate hard-coded HTTP URLs in a theme, plugin, or stored content and should be corrected rather than hidden.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Add HSTS only when the entire intended scope is ready
HTTP Strict Transport Security tells capable browsers to refuse HTTP for the policy duration. Enable it only after every hostname and subdomain you intend to include works over HTTPS, because a browser that honors the policy will enforce that decision. A one-year example is:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;Do not add includeSubDomains while an administration, mail, staging, or legacy subdomain still requires HTTP. HSTS does not replace certificate renewal or the HTTP-to-HTTPS redirect.
5. Make reverse-proxy HTTPS handling explicit
When a load balancer, CDN, or ingress proxy terminates TLS, the connection from that proxy to Nginx may be HTTP even though the visitor used HTTPS. The proxy must pass the original scheme, commonly in X-Forwarded-Proto, and WordPress must be told how to interpret it. If the signals disagree, visitors can see redirect loops, mixed-content URLs, or an apparently insecure dashboard.
Configure the trusted proxy to set the header rather than forwarding an arbitrary client-supplied value. The proxy-to-origin path should be restricted so outside clients cannot impersonate it. In wp-config.php, a typical conditional is:
Recommended Free Tools
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
&& strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
$_SERVER['HTTPS'] = 'on';
}
define( 'FORCE_SSL_ADMIN', true );Use this only when the header is controlled by your known proxy path. If you have multiple proxies, document which one is authoritative and restrict trust by network or address at the edge. Verify the result with browser developer tools and a command-line request through the public hostname; the origin-only hostname may legitimately behave differently.
6. Reduce login and brute-force abuse
Server rules cannot compensate for reused passwords. Give every administrator a long, unique password, enable two-step authentication, remove unused accounts, and use the least privilege that permits each person or integration to work. Restrict administrative access by network or VPN where the operating model allows it, but provide a tested break-glass account for emergencies.
Rate-limit the login endpoint
Nginx can slow repeated requests before they consume PHP workers. Define the zone in the http context and apply it only to the login endpoint:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
http {
limit_req_zone $binary_remote_addr zone=wp_login:10m rate=1r/s;
server {
location = /wp-login.php {
limit_req zone=wp_login burst=5;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTPS on;
fastcgi_pass wordpress_php;
}
}
}The values above are an example starting point, not a universal policy. Account for shared corporate NAT addresses, mobile users, editors, XML-RPC consumers, and uptime checks before tightening the burst or rate. Watch for legitimate 429 responses and adjust deliberately.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use a WAF when the threat model warrants it
A web application firewall or ModSecurity rule set can detect and block patterns that a few Nginx locations cannot. WordPress specifically identifies the OWASP Core Rule Set as an example of server-layer detection and blocking. Run rules in detection mode first, review false positives, and create narrow exceptions for required REST API routes, webhooks, or XML-RPC clients rather than disabling protection globally.
7. Protect application files, permissions, and editing functions
Keep wp-config.php outside the web root when practical, or ensure that only the file owner and the web process can read it. The web process should not have blanket write access to the whole installation. Limit write access to directories that genuinely need it, usually media and carefully managed update paths.
Disable the built-in dashboard editor so a stolen administrator session cannot immediately write PHP into a plugin or theme:
define( 'DISALLOW_FILE_EDIT', true );This setting does not replace updates or backups; it removes one high-impact editing path. Use a controlled deployment process for code changes, and keep a documented method for updating plugins and themes when the editor is unavailable.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAfter updates, check ownership and permissions again. An owner mismatch can make updates fail; overly broad group or world write permissions can let a compromised process alter executable code. Test an update on staging, then verify that the production process can read the release and write only where intended.
8. Preserve logs, backups, and monitoring
Retain Nginx access and error logs, PHP-FPM errors, authentication events, and relevant WordPress activity. Include denied requests in a log stream that is protected from tampering and has enough retention to investigate a delayed discovery. Alert on unusual administrator logins, repeated login failures, new PHP files under media directories, unexpected configuration changes, and sudden error-rate changes.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Keep backups independent of the live server. Include the database, uploaded media, configuration, certificates or renewal state, and deployment metadata needed to rebuild the site. The appropriate frequency and retention depend on your recovery-point and recovery-time objectives; there is no single schedule that fits every site. Test restoration on separate infrastructure, measure how long it takes, and record which credentials and DNS steps are required.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.9. Validate the configuration before and after reload
- Back up the active configuration. Save the current Nginx files, PHP-FPM pool settings, WordPress configuration, and database before editing.
- Check syntax. Run
nginx -t. Do not reload if it reports an error; resolve the file and line number first. - Reload safely. Use your service manager to reload Nginx during a controlled window rather than stopping it unnecessarily.
- Check both schemes. Request the HTTP URL and confirm a single redirect to HTTPS, then inspect the certificate and final status code.
- Exercise WordPress. Test a public page, a 404,
wp-login.php, a dashboard page, a REST API request, a media upload, a download from uploads, and a scheduled task. - Verify denials. Confirm that requests for
/.env,/.htaccess,/wp-config.php, and an invented.phpfile under uploads are denied and logged. - Test the proxy path. Repeat the HTTPS and dashboard tests through the public load balancer or CDN, not only against the origin.
- Review logs. Look for 403, 404, 429, 500, and 502 responses, PHP warnings, and unexpected rewrites immediately after the reload.
- Confirm recovery. Periodically restore a backup and verify that the restored site can be brought online with the documented runbook.
10. Choose an operating model deliberately
The controls are the same goals, but responsibility changes depending on where WordPress runs. The following comparison helps identify what must be verified in a contract or architecture review; it does not rank providers.
| Operating model | Server configuration control | Updates and patching | Logs and backups | Rate limiting, TLS, and recovery | Compatibility considerations |
|---|---|---|---|---|---|
| Self-managed Nginx | Full control over locations, PHP-FPM, headers, and network policy. | You own WordPress, PHP, database, operating-system, and Nginx maintenance. | You must define retention, isolation, alerting, and restore tests. | You configure Nginx limits or a WAF, certificate renewal, HSTS timing, and the recovery runbook. | Maximum flexibility, but every plugin, REST client, XML-RPC consumer, and multisite path must be tested by your team. |
| Managed WordPress host | Some server directives and PHP settings may be restricted. | The service may handle parts of the platform patching; confirm what remains your responsibility. | Verify backup frequency, retention, off-site isolation, log access, and whether restoration is self-service or assisted. | Confirm who operates rate limits, bot controls, certificates, HSTS, incident response, and recovery support. | Check whether custom Nginx rules, unusual plugins, REST integrations, XML-RPC, and multisite are supported. |
| Front-end WAF or CDN with your Nginx origin | You retain origin configuration, while edge rules add another policy layer. | You still patch WordPress and the origin unless another service contract says otherwise. | Collect edge and origin logs together; verify that backups do not depend on the edge cache. | Edge rate limits and TLS termination must agree with origin headers, trusted proxy ranges, and HSTS scope. | Allow legitimate API, webhook, XML-RPC, and multisite traffic through both the edge and origin policies. |
Common failures and their fixes
502 Bad Gateway after a PHP change
Check that the PHP-FPM service is running, the socket path in fastcgi_pass exists, and the Nginx worker can access it. A PHP version upgrade often changes the socket filename. Review the Nginx error log and PHP-FPM log before reverting.
Redirect loop behind a proxy
Confirm that the proxy sets X-Forwarded-Proto to the visitor’s original scheme and that only the trusted proxy path is allowed to supply it. Verify the WordPress conditional and remove conflicting HTTPS-detection code from plugins or configuration fragments.
Media uploads return 403
Inspect the deny regex for an overly broad match. It should block PHP execution in the media directory, not ordinary image or document extensions. Test a harmless download and an intentionally named PHP file separately.
REST API, webhook, or XML-RPC clients fail
Review 429 responses, WAF events, and location precedence. A login rate limit or generic bot rule may be catching a legitimate integration. Permit the narrow route and authentication pattern required by the client; do not disable all filtering as a first response.
WordPress cannot update
Check file ownership, directory write permissions, available disk space, and PHP-FPM errors. Restore least privilege after the maintenance operation instead of making the entire web root writable.
Logs are empty or impossible to correlate
Confirm that the active server block writes to the expected files, that log rotation preserves recent history, and that the edge proxy’s request identifier is carried to the origin if you need cross-layer tracing.
A maintainable hardening checklist
- Supported WordPress, PHP, database, Nginx, and operating-system versions are documented.
- PHP requests pass only through the intended PHP-FPM pool and nonexistent scripts return 404.
- Hidden files,
wp-config.php, and PHP files under uploads or files are denied and logged. - HTTP redirects to HTTPS, administration uses
FORCE_SSL_ADMIN, and proxy scheme handling is tested. - HSTS scope matches the subdomains that are actually ready for HTTPS.
- Administrators use unique passwords, two-step authentication, and least privilege.
- Login abuse is rate-limited or covered by a tuned WAF, with legitimate integrations tested.
- Dashboard file editing is disabled and filesystem write permissions are narrow.
- Backups are independent, retained for the required recovery objectives, and restored in tests.
- Access, error, PHP, authentication, and denied-request logs are retained and monitored.
- Every Nginx change passes
nginx -tand a post-reload functional test.
Defense in depth is the result: current software closes known defects, Nginx limits what reaches PHP, HTTPS protects credentials, account controls reduce takeover risk, and tested recovery prevents one incident from becoming a permanent outage.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
