What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Run WordPress over HTTPS on CentOS by putting Nginx in front of PHP-FPM, installing a certificate whose names match your domain, redirecting port 80 to port 443, and setting WordPress’s canonical URLs to https://. Unlike Apache, Nginx does not read .htaccess, so the WordPress rewrite, security, and redirect rules must be written in administrator-managed Nginx server blocks.
The procedure below keeps SELinux enforcing, persists firewalld rules, protects the private key, blocks PHP execution in uploads, and gives you tests for the certificate, redirect, login page, media uploads, and configuration before you reload the service.
What the finished setup looks like
A browser resolves your domain to the CentOS host. Firewalld permits TCP 80 and 443, Nginx accepts the request, and HTTPS requests are handled by a TLS-enabled server block. Static files are served directly; requests for PHP scripts go through a PHP-FPM Unix socket or loopback listener. WordPress then uses its database and returns the page.
Port 80 remains useful even after TLS is enabled: its only job is to issue a permanent redirect to the same host and URI on HTTPS. Port 443 serves the site. Keeping both listeners available lets old bookmarks and links converge on the secure URL.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Requirements and decisions before you change the server
- A supported CentOS Stream release or a compatible, maintained Red Hat-family distribution with administrative access.
- A DNS record for every production hostname you will put in the certificate and Nginx
server_namedirective, such asexample.comandwww.example.com. - Nginx, PHP-FPM, the PHP extensions required by your WordPress version and plugins, and a supported database installed with the distribution’s package tooling.
- A dedicated site root, for example
/var/www/example.com. Do not make the entire tree world-writable. - A certificate and private key issued for the exact public hostnames. Your certificate authority may require DNS or HTTP validation, so complete that validation before depending on automatic renewal.
- A decision about whether TLS terminates directly at Nginx or at a trusted reverse proxy. The latter requires an explicit forwarded-protocol configuration in WordPress.
Package names and default socket paths can differ between CentOS Stream releases and compatible distributions. Confirm the installed PHP-FPM pool’s listener and use that exact value in Nginx rather than copying a path that does not exist on your host.
Prepare the CentOS host
Install the web and PHP components
Use the distribution’s repositories and keep the package set limited to what the site needs. A typical installation includes Nginx, PHP-FPM, the MySQL-compatible PHP driver, and common extensions:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →sudo dnf install nginx php-fpm php-mysqlnd php-gd php-mbstring php-xml php-json php-opcache php-curl php-zipInstall and initialize your supported database separately, then create a database and least-privilege database user for WordPress. The database credentials belong in wp-config.php; they are unrelated to the TLS certificate.
Create the site root and service ownership
sudo mkdir -p /var/www/example.com
sudo chown -R nginx:nginx /var/www/example.comUse the account and group configured for your Nginx and PHP-FPM services if they are not named nginx. Ownership alone does not override SELinux. A file can have apparently correct Unix mode bits and still be denied by the policy, so apply and verify contexts before diagnosing a denial as an ordinary permission problem.
Label web content for SELinux
Keep SELinux enforcing. For a static WordPress tree, the web-content type is normally appropriate; directories that must be written by PHP, such as uploads, need the writable web-content type. The exact policy package and semanage command availability depend on your release.
sudo semanage fcontext -a -t httpd_sys_content_t '/var/www/example.com(/.*)?'
sudo semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/example.com/wp-content/uploads(/.*)?'
sudo restorecon -Rv /var/www/example.comIf semanage is missing, install the distribution package that provides SELinux management tools rather than disabling SELinux. Later, use ls -Z to inspect labels and review AVC records when a request is denied.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Configure PHP-FPM and verify its listener
PHP-FPM can listen on a Unix socket or a loopback TCP address. A Unix socket avoids exposing a local TCP port, but both designs work when Nginx and PHP-FPM use the same endpoint.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Unix-socket example
Edit the active pool, commonly /etc/php-fpm.d/www.conf, and set the pool account and socket. Keep the socket path consistent with the Nginx configuration that follows:
[www]
user = nginx
group = nginx
listen = /run/php-fpm/www.sock
listen.owner = nginx
listen.group = nginx
listen.mode = 0660The file may already contain these keys with different values. Change only the relevant settings, then test and start PHP-FPM:
sudo php-fpm -t
sudo systemctl enable --now php-fpm
sudo systemctl status php-fpmIf your pool listens on a path such as /var/run/php-fpm/www.sock or on 127.0.0.1:9000, use that actual listener in fastcgi_pass. A mismatch is the usual cause of an Nginx 502 response.
Choose an upload limit deliberately
WordPress media uploads are constrained by PHP’s upload_max_filesize and post_max_size, as well as Nginx’s client_max_body_size. Set values appropriate to your media workload in the active PHP configuration and server block; do not assume a large limit is harmless. After changing PHP settings, restart PHP-FPM so workers read the new values.
Create the Nginx HTTP and HTTPS server blocks
Place a site configuration in the directory used by your distribution, commonly under /etc/nginx/conf.d/. Replace the example names and paths. The first block handles only the redirect; the second handles WordPress.
Port 80: one permanent redirect
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}$host preserves the requested hostname and $request_uri preserves the path and query string. This produces one redirect instead of sending visitors through a sequence of changing URLs. If you use an HTTP-based certificate-authority challenge, add a narrowly scoped /.well-known/acme-challenge/ location before enforcing the redirect, or use the authority’s DNS-based validation method.
Port 443: TLS and the WordPress front controller
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
root /var/www/example.com;
index index.php;
ssl_certificate /etc/pki/tls/certs/example.com/fullchain.pem;
ssl_certificate_key /etc/pki/tls/private/example.com/privkey.pem;
client_max_body_size 64m;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~* /wp-content/uploads/.*.php$ {
deny all;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php-fpm/www.sock;
}
location ~ /. {
deny all;
}
}The try_files fallback sends WordPress permalinks to index.php. The PHP location verifies that a requested script exists before handing it to PHP-FPM. The uploads rule appears before the general PHP rule so a malicious script below wp-content/uploads cannot execute. The dot-file rule protects files such as .env and .htaccess; if you use HTTP-01 certificate renewal, allow the required .well-known challenge path explicitly rather than exposing other hidden files.
Recommended Free Tools
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Do not copy Apache directives into this file. Nginx will not read a WordPress .htaccess, and WordPress cannot edit Nginx’s configuration automatically. Any rewrite, access restriction, or redirect that the site needs must be represented in these server blocks or in included Nginx configuration.
Install the certificate and protect the private key
Install the certificate chain and key at the paths named by ssl_certificate and ssl_certificate_key. The certificate file should contain the server certificate followed by the required intermediate certificates in the order supplied by your certificate authority. An incorrectly ordered or incomplete chain can prevent Nginx from starting or cause clients to report an untrusted connection.
The private key is sensitive. Restrict it to root and the account that must read it; the Nginx master process must nevertheless be able to open it. A common pattern is a root-owned file with a group readable by the Nginx service group, but use the ownership and permissions that match your distribution’s service model.
sudo chown root:nginx /etc/pki/tls/private/example.com/privkey.pem
sudo chmod 640 /etc/pki/tls/private/example.com/privkey.pemDo not place the key in the web root or make it world-readable. Configure renewal using the certificate authority’s supported method and ensure renewal updates the same files, preserves their permissions, and reloads Nginx only after a successful configuration test.
Validate Nginx before every reload
Syntax-check the complete configuration, including included files, before applying a change:
sudo nginx -t
sudo systemctl reload nginxIf the test fails, do not reload. Read the reported file and line number. Typical causes are a certificate path typo, an unreadable key, a duplicate server_name, an invalid directive, or a missing semicolon.
Set WordPress’s canonical HTTPS URLs
Use the dashboard after HTTPS responds
Open the secure site and go to Settings > General. Set both WordPress Address (URL) and Site Address (URL) to the HTTPS form, for example https://example.com. Save once the HTTPS virtual host is working. Changing these values before the certificate and server block are ready can lock you out with a redirect or connection error.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Force secure administration
Add this line to wp-config.php above the comment that says editing is finished:
Free tools Windows power users keep installed
One-click scans. No signup required.
define( 'FORCE_SSL_ADMIN', true );This forces login and administration requests to use TLS. It does not replace the Nginx redirect or the two URL settings; all three address different parts of the request flow.
Handle a trusted TLS-terminating proxy
If a load balancer or reverse proxy terminates TLS before forwarding to Nginx, the connection between the proxy and WordPress may be plain HTTP even though the visitor used HTTPS. Configure the proxy to send X-Forwarded-Proto: https and, only when the request came from that trusted proxy, add the corresponding detection to wp-config.php:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
$_SERVER['HTTPS'] = 'on';
}Do not honor an arbitrary client-supplied forwarded header. Restrict this behavior to the proxy network or have the proxy sanitize and set the header. Without correct detection, WordPress can repeatedly redirect an already secure request.
Open only the required firewall services
Allow HTTP and HTTPS in firewalld and make the changes persistent. The first commands affect the permanent configuration; reloading applies it to the running firewall.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchessudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --list-allAlternatively, add TCP ports 80 and 443 explicitly if your zone policy does not define the named services. Runtime-only rules disappear after a restart, so check both the runtime and permanent listings. Do not expose the PHP-FPM socket or database port to the public network unless a separate, justified architecture requires it.
Apply WordPress-specific Nginx restrictions
Block script execution in writable directories
Media directories are writable by design and should contain images, documents, and other uploads—not executable PHP. The uploads location in the HTTPS block denies PHP requests below wp-content/uploads. If your installation uses another writable directory, add a similarly narrow rule for that path.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
To verify the rule, create a harmless file such as wp-content/uploads/nginx-test.php containing a simple PHP opening tag and a benign output statement, request it over HTTPS, and confirm that Nginx returns a denial rather than executing it. Remove the test file immediately afterward. This check tests the effective location ordering, not just the text of the configuration.
Protect hidden and configuration files
The hidden-file rule denies requests for dot-prefixed paths, which protects accidental disclosures of .env, version-control metadata, and .htaccess. Keep the certificate challenge exception narrowly scoped if your renewal method needs it. Never solve a challenge by broadly allowing every hidden file.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Verification checklist after deployment
- Run
sudo nginx -tand confirm that the reload completes without an error. - Request the old URL with
curl -I http://example.com/. Expect one301response whoseLocationuses HTTPS and retains the requested path and query string. - Request
curl -I https://example.com/and confirm a successful response from the secure virtual host. - Inspect the certificate and hostname with
openssl s_client -connect example.com:443 -servername example.com -showcerts. Check the validity dates, subject names or SANs, and intermediate chain. - Open
/wp-login.php, sign in, and visit the dashboard over HTTPS. Confirm that the address bar remains secure through navigation. - View page source and browser developer-network requests. Enqueued scripts, styles, images, and forms should use HTTPS or relative URLs; HTTP assets can trigger mixed-content failures.
- Upload an ordinary media file and confirm it is reachable at its expected HTTPS URL.
- Place the temporary PHP file in uploads, request it, and confirm the deny rule blocks execution; then delete the file.
- Check both firewalld listings to verify that HTTP and HTTPS are present in the active and persistent configurations.
- Review Nginx and PHP-FPM logs, the system journal, and SELinux AVC records for denied files, socket errors, or unexpected redirects.
Troubleshoot the failures that matter most
| Symptom | Likely cause | What to check |
|---|---|---|
| 502 Bad Gateway | Nginx cannot reach PHP-FPM. | Confirm PHP-FPM is running, compare its actual listen value with fastcgi_pass, and check socket ownership and SELinux denials. |
| Nginx refuses to start after certificate installation | The key is unreadable, the path is wrong, or the chain is malformed. | Run nginx -t, verify file permissions and labels, and confirm that the certificate file contains the complete chain in the authority’s order. |
| Browser reports a certificate-name error | The requested hostname is not covered by the certificate. | Compare the browser hostname with the certificate SANs and the Nginx server_name values; obtain a certificate covering every production name. |
| Infinite HTTP/HTTPS redirect loop | A proxy terminates TLS but WordPress does not receive trusted HTTPS detection, or multiple layers apply conflicting redirects. | Inspect the forwarded-protocol header, restrict trust to the proxy, and identify which layer sends each redirect. |
| Permalinks return 404 while the home page works | The front-controller fallback is missing or the request is handled by the wrong server block. | Check the HTTPS block’s try_files $uri $uri/ /index.php?$args;, the active root, and the selected server_name. |
| Uploads fail after enabling SELinux | The uploads directory lacks a writable SELinux context or PHP cannot write it. | Inspect with ls -Z, review AVC denials, apply the appropriate writable web-content label, and verify Unix ownership without making the whole site writable. |
| A PHP file in uploads executes | The uploads-specific regex is absent, does not match the actual path, or appears after a conflicting location. | Test the exact URL, place the deny rule before the general PHP rule, run nginx -t, reload, and repeat the test. |
| HTTP remains reachable after the firewall change | That is expected when port 80 is open for the redirect. | Check that the response is a single permanent redirect to HTTPS rather than serving WordPress content over plain HTTP. |
Keep the installation maintainable
HTTPS is not a substitute for updates. Keep WordPress, its plugins and themes, PHP, Nginx, the database, and the operating system on supported, maintained releases. Obsolete PHP and database versions can expose a WordPress site to security vulnerabilities and may stop receiving fixes required by current software.
Schedule backups of the database, wp-content, and the Nginx, PHP-FPM, and certificate configuration. Store backups outside the server and periodically test restoration. Monitor certificate expiry, automate renewal using the certificate authority’s supported mechanism, and perform a dry-run or equivalent renewal test before the current certificate is near expiration. After renewal, run nginx -t and reload only on success.
Keep a short change record for server-block edits, PHP-FPM pool changes, firewall rules, and SELinux labels. This makes it possible to roll back a failed update without replacing the security controls with broad permissions.
Self-managed CentOS/Nginx or managed WordPress hosting?
Running the stack yourself is appropriate when you need direct control over Nginx routing, PHP-FPM pools, filesystem labels, firewall policy, and performance tuning. It also means you own every patch, certificate renewal, backup, monitoring, incident response, and compatibility decision.
| Decision area | Self-managed CentOS with Nginx | Managed WordPress service |
|---|---|---|
| Administrative effort | You configure and maintain the operating system, web server, PHP-FPM, database, and WordPress. | The provider handles much of the platform administration, subject to its documented limits. |
| Nginx, PHP-FPM, and SELinux control | Full control over server blocks, pools, labels, and firewall policy. | Usually limited to the controls exposed by the service. |
| Certificate automation | You install the chain and key, secure the key, configure renewal, and reload Nginx safely. | Often integrated, but you must verify hostname coverage, renewal behavior, and access to the resulting certificate. |
| Patching responsibility | You schedule and test updates for every layer. | The provider manages platform patches; you still maintain WordPress code, plugins, themes, and account access. |
| Backups and monitoring | You select storage, retention, alerting, and restoration tests. | Backup and monitoring features depend on the service contract and should be verified rather than assumed. |
| Performance tuning | You can tune PHP-FPM workers, Nginx behavior, caching, and the host itself. | Tuning is constrained by the platform but may require less operational work. |
| Support model | You troubleshoot logs, SELinux, firewalld, and application failures yourself or with your own administrator. | Support scope varies; confirm whether it covers Nginx, PHP errors, WordPress, certificates, and recovery. |
Choose the self-managed route only if you can maintain the full chain of responsibilities. A managed service reduces server administration but does not remove the need to verify HTTPS behavior, updates, backups, and WordPress security.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
