Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
A reliable WordPress HTTPS setup uses two Nginx server blocks: port 80 remains available for ACME certificate challenges and redirects normal traffic to one canonical HTTPS hostname, while port 443 terminates TLS and passes PHP requests to PHP-FPM. The configuration below also supports WordPress pretty permalinks, blocks sensitive files, serves static assets efficiently, and leaves FastCGI page caching disabled until you can test every state-changing workflow.
What the finished configuration does
The design separates responsibilities instead of trying to handle HTTP and HTTPS in one block:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Port 80: answers HTTP requests, leaves
/.well-known/acme-challenge/available for certificate issuance and renewal, and sends every other request to the canonical HTTPS hostname with a 301 redirect. - Port 443: presents the certificate, accepts TLS 1.2 and 1.3, serves the WordPress document root, routes pretty permalinks to
index.php, and sends PHP scripts to PHP-FPM. - WordPress: is configured with an
https://site URL so generated links, forms and administrative redirects do not fall back to HTTP.
Replace the example domain, document root and PHP-FPM socket with values from your server. The socket shown in the example is deliberately generic; copying it without checking your installed PHP version is a common cause of 502 errors.
Prerequisites before editing Nginx
- Nginx is installed and can bind to ports 80 and 443.
- The WordPress files are in the document root you will specify, such as
/var/www/example.com. - PHP-FPM is installed and running. Find its actual Unix socket or TCP listener in the PHP-FPM pool configuration and service status.
- DNS for every hostname in
server_namepoints to this host before requesting a certificate. - The Nginx worker or master process can read the certificate and private-key files, while the private key remains inaccessible to unrelated users.
- You have a backup of the current Nginx configuration before allowing an automated certificate tool to edit it.
Baseline Nginx configuration
Save the following as the site configuration loaded by your Nginx installation. If your distribution uses an enabled-sites directory, create a link from the available file rather than maintaining two independent copies.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
# HTTP: keep ACME validation available, redirect everything else
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location ^~ /.well-known/acme-challenge/ {
root /var/www/certbot;
default_type text/plain;
try_files $uri =404;
}
location / {
return 301 https://example.com$request_uri;
}
}
# HTTPS WordPress site
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
root /var/www/example.com;
index index.php index.html;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# Enable only after every covered hostname is HTTPS-ready.
add_header Strict-Transport-Security 'max-age=31536000' always;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTPS on;
fastcgi_pass unix:/run/php/php-fpm.sock;
}
location ~* /(?:.ht|wp-config.php|readme.html|license.txt) {
deny all;
}
location ~* .(css|js|jpg|jpeg|png|gif|svg|webp|ico|woff2?)$ {
expires 7d;
access_log off;
try_files $uri =404;
}
}How the port-80 block works
The ACME location is deliberately more specific than location /. A certificate authority can place a temporary token under /.well-known/acme-challenge/, retrieve it over plain HTTP, and complete validation even though normal visitors are redirected. try_files $uri =404 prevents Nginx from sending a missing challenge token into WordPress.
The redirect preserves the original path and query string through $request_uri. It sends both the bare domain and the www name to https://example.com; change that hostname if your chosen canonical name is the www variant. Keep the policy consistent in DNS, WordPress and any proxy in front of Nginx.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How the TLS block works
listen 443 ssl enables TLS on the HTTPS listener. ssl_certificate should point to the complete certificate chain, while ssl_certificate_key points to the private key. The example permits TLS 1.2 and 1.3 and uses a shared session cache with a ten-minute timeout. Do not use the obsolete standalone ssl on directive; modern Nginx enables TLS on the listen line.
The private key should be readable only by the account that needs it and by the Nginx master process. A certificate can be world-readable in many deployments, but the key should not be. Verify ownership and permissions after every certificate-tool change.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
The HSTS header tells a browser to use HTTPS for one year. It is intentionally not configured with includeSubDomains. Add that option only when every subdomain covered by the policy is guaranteed to serve valid HTTPS; otherwise one forgotten subdomain can become unreachable in browsers that cached the policy.
How WordPress routing reaches PHP-FPM
The first location serves an existing file or directory directly. If neither exists, try_files internally routes the request to /index.php while preserving query arguments. That is the front-controller pattern required for WordPress pretty permalinks.
The PHP location first checks that the requested script exists. This stops Nginx from passing arbitrary missing paths to PHP-FPM. The included FastCGI parameters provide request metadata; SCRIPT_FILENAME maps the URI to the file under the configured document root, and HTTPS on tells PHP and WordPress that the original request is secure.
Change fastcgi_pass to the socket or upstream that actually exists on the host. Typical paths include a versioned PHP socket, but the exact path varies by operating system and PHP release. If your PHP-FPM pool listens on TCP, use its configured address instead, for example an internal host and port, rather than guessing a Unix socket.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Protected and static files
The deny rule blocks Apache-style per-directory files, wp-config.php, and WordPress documentation files that can disclose implementation details. Nginx does not read .htaccess, so protecting these paths explicitly is important.
The static-asset location sets a seven-day browser expiration, disables access logging for those files and returns 404 when the requested asset does not exist. Adjust the extension list if your theme or plugins use additional font, media or map formats. Do not add PHP extensions to this static block.
Install and adapt the configuration safely
- Choose the canonical hostname. Decide whether visitors should use
example.comorwww.example.com. Put both names in the certificate andserver_nameif both resolve to this server, then redirect the secondary name to the canonical one. - Set the document root. Replace
/var/www/example.comwith the directory containingwp-admin,wp-contentandwp-includes. The Nginx account must be able to traverse the directories and read the files. - Find PHP-FPM. Check the running PHP-FPM service and pool configuration for its listen value. Replace
unix:/run/php/php-fpm.sockwith that exact socket or a configured TCP upstream. - Create the ACME webroot. Make
/var/www/certbotavailable to Nginx and ensure the Nginx account can read challenge files placed there. Do not place the challenge location behind a WordPress rewrite. - Test before reloading. Run
nginx -t. Fix every syntax error, missing include, invalid certificate path or permission failure before applying the configuration. - Reload gracefully. Reload Nginx through your operating system’s service manager. A graceful reload lets existing connections finish while new workers use the corrected configuration.
Obtain and renew the certificate
Certificate tools that integrate with Nginx can request a certificate and optionally edit the server block. Back up your configuration first, review every automated change, and retain the explicit ACME location shown above. HTTP validation still needs port 80 reachable from the public internet; redirecting all requests without an exception for the challenge path can make issuance and renewal fail.
- Point the certificate’s requested names to this server and confirm that inbound port 80 reaches Nginx.
- Run your certificate client in Nginx or webroot mode, using the document root exposed by
/.well-known/acme-challenge/. - Confirm that the resulting certificate and key paths match
ssl_certificateandssl_certificate_key. - Run
nginx -tafter issuance. Only then reload Nginx so the new certificate is active. - Test the renewal command in its supported dry-run mode and verify that a successful renewal is followed by a successful Nginx reload. A renewed file on disk is not enough if workers still hold the old certificate.
Do not remove port 80 after HTTPS works. It remains part of the HTTP-01 validation path unless your certificate workflow uses a different challenge type.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Set WordPress to use HTTPS
Installing a valid certificate does not automatically change URLs stored by WordPress. In the WordPress settings, set both the WordPress Address and Site Address to the same canonical https:// hostname used by the redirect. Save the settings only after the HTTPS virtual host is serving correctly, or you can lock yourself into a URL that is not yet reachable.
For deployments that need fixed values, WordPress also documents HTTPS administration constants. Use those only when they match the public URL and your deployment process manages configuration files deliberately.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf TLS terminates at a reverse proxy or load balancer before traffic reaches Nginx, the proxy must pass the original protocol and Nginx/PHP must trust it consistently. Otherwise WordPress may generate HTTP links or repeatedly redirect between HTTP and HTTPS. The exact forwarded-protocol directive depends on the proxy topology, so do not copy a generic header rule without matching it to the proxy’s documented behavior.
Configuration choices that change the design
| Decision | Use the baseline when | What changes |
|---|---|---|
| Single site versus multisite | You host one ordinary WordPress site. | Multisite may require additional hostnames, wildcard DNS and network-specific rewrite rules; confirm those requirements before reusing this server block. |
| Unix socket versus TCP PHP-FPM | Nginx and PHP-FPM run on the same machine. | A Unix socket avoids a network hop. A TCP upstream is appropriate when PHP-FPM is on another host or container, but it adds service discovery and firewall considerations. |
| Direct TLS termination versus reverse proxy | This Nginx host owns the certificate and accepts port 443. | With a proxy, certificate handling and client-IP/protocol forwarding move partly upstream; configure trust boundaries explicitly. |
| Caching disabled versus FastCGI cache | You are establishing a new site or troubleshooting behavior. | Disabling cache is safest. A cache can reduce PHP work only after bypass rules protect dynamic requests. |
| Certbot-managed certificates versus another lifecycle tool | Your certificate client writes files and can reload Nginx. | Any alternative must still preserve ACME reachability, secure key permissions, configuration testing and a post-renewal reload. |
Why FastCGI caching is not in the baseline
Page caching can reduce PHP-FPM load, but an incorrect cache serves one user’s state to another or hides a newly submitted action. Start with caching disabled. If you later add an explicit FastCGI cache zone, bypass both storing and serving cached content for:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- POST requests and requests with query strings that change the response.
/wp-admin/, login endpoints and XML-RPC.- Feeds, previews, comments and other state-changing or user-specific endpoints.
- Requests carrying logged-in or commenting-user cookies.
- Plugin routes such as carts, checkout, account pages and custom API endpoints.
Test anonymous pages, login and logout, comments, previews, plugin APIs and any commerce workflow after enabling a cache. A cache policy is part of the application design, not a drop-in performance switch.
Validation checklist after deployment
- Run
nginx -tand inspect the error log after every configuration or certificate change. - Request the HTTP URL and confirm exactly one redirect to the selected canonical HTTPS hostname.
- Open the HTTPS site and inspect the certificate name, chain and expiration date in a browser or TLS client.
- Load the home page, a deep pretty-permalink URL,
/wp-admin/, a known PHP request and representative CSS, JavaScript, image and font files. - Check that WordPress-generated links, forms, media URLs and administrative redirects all use HTTPS.
- Verify that the ACME challenge path returns a file from the challenge webroot instead of a WordPress page or redirect loop.
- Exercise comments, login, previews and plugin APIs. These must not be served from a public FastCGI cache.
- Run a renewal test and confirm that Nginx reloads successfully with the renewed certificate.
Troubleshooting common failures
502 Bad Gateway
Nginx cannot connect to PHP-FPM. Check that the service is running, inspect its listen setting, and compare it character-for-character with fastcgi_pass. Confirm socket ownership and permissions, or use the correct TCP address when PHP-FPM is remote.
Recommended Free Tools
404 responses for every pretty permalink
Ensure the HTTPS server’s document root contains the WordPress files and that the exact try_files $uri $uri/ /index.php?$args; rule is inside location /. Confirm that the PHP location’s existence check can find index.php.
Certificate issuance fails with an ACME challenge error
Check DNS and inbound port 80 first. Then place a test file under the configured challenge root and request it over HTTP. The request must reach the ACME location and return the file directly. A broad redirect, a different server block winning the port-80 match, or filesystem permissions can all prevent validation.
Redirect loops or HTTP links after enabling SSL
Make the WordPress Address and Site Address identical canonical HTTPS URLs. If a proxy terminates TLS, pass the original protocol and configure Nginx and WordPress to trust that value consistently. Remove conflicting redirect rules from other layers before adding another one.
403 responses for legitimate files
Review the sensitive-path regular expression and filesystem permissions. The deny rule should cover protected configuration and documentation files, not your entire document root. Confirm that the Nginx account can traverse each parent directory.
HSTS makes a subdomain unreachable
If HSTS was enabled with a broad scope too early, browsers may refuse HTTP access until the policy expires. Avoid includeSubDomains unless every covered name has working HTTPS, and first test the one-year policy only on hostnames you control completely.
Quick Recap
Operational rules worth keeping
- Keep the ACME location in the port-80 block for the entire certificate lifecycle.
- Never guess a PHP-FPM socket path or certificate filename; verify both on the host.
- Test configuration before every reload, including reloads triggered by certificate renewal.
- Protect the private key more tightly than public certificate files.
- Introduce caching only with explicit bypasses for authenticated, administrative and state-changing requests.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
