The dependable way to harden WordPress on Nginx is layered protection: run supported software, send only real PHP files to PHP-FPM, block execution in uploads, deny hidden files, enforce HTTPS (including wp-admin), protect configuration and administrator accounts, and keep tested backups and logs. Nginx rules reduce exposure, but they do not replace WordPress updates, authentication controls, or recovery planning.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
1. Start with a supported, known inventory
Security work is easier when you know exactly what is running. Record the WordPress version, active plugins and themes, PHP version, database engine and version, operating-system release, Nginx version, PHP-FPM pool, document-root path, TLS terminator, and any CDN or load balancer in front of the server. Remove abandoned plugins, themes, test sites, and unused virtual hosts; every enabled component is another code path to maintain.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →WordPress explains that older software is more exposed because vulnerability details commonly become public after a fix is released. The current requirements page recommends the following baseline:
| Component | Current recommendation | Why it matters |
|---|---|---|
| PHP | 8.3 or newer | Older branches are identified as end-of-life and no longer receive the same security maintenance. |
| Database | MariaDB 10.11 or newer, or MySQL 8.0 or newer | Supported database branches receive security fixes and compatibility testing. |
| Transport | HTTPS | Protects credentials, administration traffic, cookies, and API requests in transit. |
Patch in a controlled order
- Take an independent backup and confirm that it can be read before changing production.
- Update the operating system, Nginx, PHP and PHP-FPM, and the database through your normal package-management process.
- Update WordPress core, plugins, and themes from trusted sources; remove components that are no longer maintained.
- Review the site after each layer changes. Pay particular attention to PHP extensions, image processing, scheduled tasks, payment or game-related integrations, and custom code.
Do not treat a version number as proof of safety. A supported release can still be misconfigured, and a plugin can introduce a vulnerability between your maintenance windows. Subscribe to security notices for the software you actually run and keep a written inventory so an emergency update does not miss a second site or an inactive-looking virtual host.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
2. Establish a narrow Nginx-to-PHP-FPM boundary
WordPress supports Nginx, but the security boundary is the hand-off from Nginx to PHP-FPM. Nginx should serve static files directly and pass only intended PHP requests to the FPM socket or upstream. Never use a catch-all rule that sends arbitrary filenames, uploaded data, or missing paths to PHP.
A conservative server block pattern
The following is a starting pattern, not a copy-and-paste guarantee. Replace the domain, document root, log locations, and PHP-FPM socket with values from your host. If your distribution uses a TCP upstream instead of a Unix socket, use the documented upstream address.
server {
listen 443 ssl http2;
server_name example.com www.example.com;
root /var/www/example;
index index.php index.html;
access_log /var/log/nginx/example.access.log;
error_log /var/log/nginx/example.error.log;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
}try_files $uri =404;prevents a request for a non-existent filename from being interpreted as a PHP script.fastcgi_param SCRIPT_FILENAMEmust point to the real file under the document root; an incorrect path causes failures or can expose an unintended file.- The socket name is installation-specific. A server running another supported PHP branch will have a different socket path.
- Keep access and error logs enabled. They are needed to investigate denied requests, failed logins, and suspicious changes.
Validate before reloading
Run nginx -t with the same privileges and configuration path used by the service. Fix every syntax or permission error before reloading. Reload during a controlled window, then test a public page, a known static asset, a normal PHP request, and an intentionally missing PHP path. A configuration that parses successfully can still point at the wrong root or socket.
3. Block hidden files and PHP execution in writable directories
WordPress uploads are data, not application code. If an attacker manages to place a PHP file in wp-content/uploads or a multisite files directory, Nginx must refuse to execute it even when the filename ends in .php. Keep a log entry for the denial so repeated probes can feed your alerting or fail2ban-style controls.
location ~* ^/wp-content/uploads/.*.php$ {
deny all;
access_log /var/log/nginx/wordpress_denied.log;
}
location ~* ^/wp-content/files/.*.php$ {
deny all;
access_log /var/log/nginx/wordpress_denied.log;
}
location ~ /.(?!well-known) {
deny all;
access_log /var/log/nginx/wordpress_denied.log;
log_not_found off;
}The hidden-file rule covers files such as .htaccess, .htpasswd, and .DS_Store. The negative match for .well-known leaves a standard location available for certificate-validation files; if you use another validation method, adapt the exception to that method rather than exposing every dot-file.
Place these restrictions in the correct server block and check that a more-specific location is not accidentally bypassing them. Test with a harmless file whose name ends in .php in each writable directory. The expected result is a denied response and a corresponding log entry, never PHP-FPM execution. Do not rely on a filename extension check alone if an application or storage layer can serve files through a dynamic endpoint; review those endpoints separately.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
4. Make HTTPS universal, including administration
Use a valid certificate on the 443 server and redirect the HTTP virtual host to the same request over HTTPS:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}In wp-config.php, WordPress documents define( 'FORCE_SSL_ADMIN', true ); to require HTTPS for logins and administration. Put the constant before the line that says WordPress has stopped editing the file, and verify that every administrative bookmark, login form, cookie, and callback uses the HTTPS hostname.
Use HSTS only when the whole name is ready
HTTP Strict Transport Security tells a browser that honors it to enforce HTTPS. Add an HSTS response header only after every intended subdomain, alternate hostname, asset host, and administrative endpoint is available over HTTPS. A premature policy can lock visitors to a broken or not-yet-secured hostname; remove or shorten the policy deliberately if you discover such a problem. HSTS is a browser policy, not a replacement for the HTTP redirect or a certificate.
Check mixed content and canonical URLs
After enabling TLS, inspect page source, browser developer tools, feeds, REST responses, and scheduled-task callbacks for http:// URLs. Correct the site and home URLs in WordPress and fix hard-coded references in themes, plugins, and custom code. Redirect loops or partially secure pages usually indicate inconsistent scheme detection, which is especially common when a proxy terminates TLS.
5. Handle a reverse proxy without creating redirect loops
When a CDN, load balancer, or ingress proxy terminates TLS, the connection from that proxy to Nginx may be HTTP even though the visitor used HTTPS. The proxy must pass the original scheme in X-Forwarded-Proto, and WordPress must be taught to recognize it. Trust this header only on the controlled proxy path; an internet client must not be able to choose its value.
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
$_SERVER['HTTPS'] = 'on';
}Use the equivalent conditional recommended for your proxy and ensure the edge overwrites, rather than blindly forwards, an inbound X-Forwarded-Proto. If WordPress believes an HTTPS request is HTTP, it can generate insecure links or repeatedly redirect to the same URL. If it believes an unencrypted request is HTTPS, secure-cookie and transport assumptions can be wrong. Test both direct origin access (if it is allowed) and the public proxy path.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
6. Reduce account takeover and brute-force exposure
Strengthen identities first
- Give every administrator a long, unique password that is not reused on email, hosting, or gaming accounts.
- Use two-step authentication for administrators and other high-impact users.
- Give editors, authors, and service accounts the least privilege they need; do not share an administrator login.
- Remove dormant accounts and review administrator membership after staff or contractor changes.
- Restrict access to
wp-adminby VPN, corporate network, allowlist, or an additional access control when your workflow permits it.
Add a request-layer control
Nginx rate limiting can slow repeated requests to /wp-login.php and other authentication endpoints. A generic pattern uses limit_req_zone at the http level and limit_req in a login location. Choose the rate and burst for your normal traffic, test from a real administrator connection, and monitor false positives; there is no universal safe number for every site.
# In the http context, choose values that match your traffic:
limit_req_zone $binary_remote_addr zone=wp_login:10m rate=5r/m;
# In the WordPress server block:
location = /wp-login.php {
limit_req zone=wp_login burst=10 nodelay;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}The example is a starting point, not an attack-rate statistic or a promise of protection. Account for shared office addresses, mobile carrier NAT, XML-RPC clients, REST integrations, and legitimate automation before tightening it. A front-end WAF or ModSecurity deployment with the OWASP Core Rule Set can add server-layer detection and blocking; tune rules in a monitored mode first when compatibility is uncertain.
Do not break legitimate APIs blindly
Some publishing workflows, mobile apps, game-community integrations, or multisite tools use the REST API or XML-RPC. Blocking an endpoint may reduce noise but can also disable a required client. Identify the callers, protect them with authentication and rate controls, and test the exact integrations before denying an entire path. Keep the distinction clear: a login throttle limits abuse; it does not replace strong passwords or two-step authentication.
7. Protect configuration, secrets, and writable permissions
Keep wp-config.php out of reach
When practical, place wp-config.php one directory above the web root so Nginx cannot serve it as a normal document. If the deployment requires it under the root, restrict it so only the site owner and the web-server account can read it, and verify that Nginx never treats it as downloadable content. Never commit database passwords, salts, private keys, or API tokens to a public repository or paste them into support tickets.
Disable the dashboard file editor
Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. This removes the built-in theme and plugin editor, so a stolen administrator session cannot immediately write PHP through the dashboard. It does not stop a user who already has filesystem access, and it does not replace patching or two-step authentication.
Test ownership after every deployment
WordPress needs to write specific directories for updates and media, but broad write access makes a compromise more damaging. Use the narrowest ownership and permissions that support your update process. After an update, check that the web server can write where intended and cannot write to configuration or application code unnecessarily. Ownership mistakes can either break legitimate updates or encourage operators to grant unsafe permissions as a quick fix.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
8. Build recovery, logging, and monitoring into the design
Backups are a recovery control, not a checkbox
Keep independent backups of the database and files, including uploads and any configuration required to rebuild the site. Choose frequency and retention from your recovery-point and recovery-time objectives; official guidance names backups but does not prescribe one schedule for every installation. Store at least one copy outside the server and protect backups from the same credentials used by WordPress.
Test restoration on a separate environment. A backup that has never been restored is an assumption, not a recovery plan. Record how to rebuild Nginx, PHP-FPM, certificates, scheduled tasks, and secrets without copying compromised files back into production.
Make logs useful
- Retain Nginx access and error logs, PHP-FPM errors, authentication events, and relevant WAF or firewall events.
- Keep the denied-request log for hidden files and upload-directory PHP probes.
- Alert on unusual administrator logins, repeated authentication failures, unexpected new PHP files, changes to plugins or themes, and sudden permission changes.
- Protect log storage from deletion by the same account that serves the site, and set a retention period that supports investigation.
Monitoring should lead to an action: who investigates, how the site is isolated, how credentials are rotated, and how a clean backup is selected. Logging without review rarely stops an intrusion.
9. Verify every change with a focused test plan
After editing Nginx, PHP-FPM, TLS, proxy headers, or WordPress configuration, run nginx -t, reload in a controlled window, and work through this checklist:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Open the home page, several internal permalinks, a 404 page, and static assets over HTTPS.
- Sign in to
/wp-admin/; confirm that the login and dashboard remain HTTPS and that cookies are issued correctly. - Open the media library and upload a normal image. Confirm that it downloads as data.
- Request a harmless
.phpfile placed in an uploads or files directory. Confirm denial and a log entry; remove the test file afterward. - Call the REST API used by your site and exercise any XML-RPC or mobile-client workflow you intentionally retained.
- Run scheduled tasks and any external webhooks, payment callbacks, or game-service integrations.
- Test through the public reverse-proxy path and, where permitted, directly against the origin. Look for redirect loops and incorrect absolute URLs.
- Review access, error, PHP-FPM, and denied-request logs for unexpected 4xx, 5xx, or permission errors.
- Confirm that a recent backup can be restored in a non-production environment.
Keep a rollback copy of the previous Nginx configuration and know how to revert a WordPress constant or proxy setting from the command line. If a reload fails, restore the last known-good configuration rather than repeatedly editing a broken file on a live server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.10. Choose the operating model that matches your capacity
There are three common ways to place these controls. The choice changes who owns each task; none removes the need to verify application behavior.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
| Operating model | Server-configuration control | Updates and patching | Logs and bot controls | TLS, backups, and recovery | Compatibility responsibility |
|---|---|---|---|---|---|
| Self-managed Nginx | You control server blocks, PHP-FPM, permissions, rate limits, and WAF rules. | You schedule and verify operating-system, Nginx, PHP, database, WordPress, plugin, and theme updates. | You retain raw access and error logs and choose Nginx or ModSecurity controls. | You issue certificates, design HSTS timing, run backups, and test restoration. | You must test REST clients, XML-RPC consumers, cron, uploads, and multisite behavior after changes. |
| Managed WordPress hosting | Provider-managed restrictions may limit custom Nginx directives and filesystem access. | The provider may handle platform patching; you still own WordPress, plugin, theme, account, and configuration decisions that remain exposed to you. | Ask what logs, retention, rate limiting, and bot controls you can inspect and tune. | Confirm backup frequency, retention, off-site independence, certificate handling, and restoration assistance in the service terms. | Verify that required plugins, REST clients, XML-RPC consumers, cron jobs, and multisite are supported before migrating. |
| Front-end WAF or CDN in front of Nginx | Origin Nginx remains yours while edge rules add another policy layer. | You still patch the origin; the edge service has its own maintenance cycle. | Edge rate limits and WAF rules can absorb common probes, but preserve origin and edge logs for correlation. | Decide whether TLS terminates at the edge, the origin, or both; pass the original scheme safely and keep an independent origin backup. | Test cache behavior, authenticated requests, REST and XML-RPC traffic, uploads, webhooks, and purge workflows. |
Evaluate the model by responsibility rather than marketing claims. Ask who can change Nginx, who receives a failed-login alert, how often backups are restored in practice, and how quickly you can isolate a compromised site.
11. Common failures and safe fixes
Apache rules pasted into Nginx
.htaccess syntax is not Nginx syntax. Translate the intent into Nginx locations and directives, then validate with nginx -t. Do not create a broad rewrite merely because a WordPress snippet works on Apache.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11502 Bad Gateway after a PHP change
Check that PHP-FPM is running, that the socket path and permissions match the Nginx worker account, and that the PHP version in the socket name matches the installed service. Read both the Nginx error log and PHP-FPM log before changing permissions.
403 responses for media or hidden paths
Confirm that the denial location matches only the intended directories and that the document root is correct. Preserve the .well-known exception if certificate validation needs it. A 403 for an attempted PHP file in uploads is expected; a 403 for an image indicates an overly broad location or filesystem permission problem.
Redirect loops behind a proxy
Compare the scheme seen by the browser, proxy, Nginx, and WordPress. Ensure the trusted proxy sets X-Forwarded-Proto, WordPress recognizes it, and direct internet clients cannot spoof it. Check canonical site URLs and remove duplicate redirect rules at different layers.
HSTS makes a hostname unreachable
Browsers that honor HSTS will continue enforcing HTTPS until the policy expires or is changed. Restore a valid certificate and HTTPS service for every affected hostname before attempting other fixes; do not add HSTS to a partially migrated domain.
Updates fail after permissions are tightened
Compare the owner and group of the document root, plugin and theme directories, and intended upload paths. Restore only the write access required by the update workflow, then recheck that wp-config.php and application code are not broadly writable by the web server.
12. A practical hardening order
If you need a sequence that minimizes lockouts, use this order:
- Inventory versions, domains, proxy layers, integrations, and current backups.
- Update supported operating-system, Nginx, PHP, database, WordPress, plugin, and theme components.
- Confirm the document root and PHP-FPM boundary, then add hidden-file and upload-PHP denials with logging.
- Deploy the certificate, HTTP redirect, administrative HTTPS setting, and carefully tested proxy scheme handling.
- Protect
wp-config.php, disable dashboard file editing, and correct ownership and permissions. - Enable strong unique credentials, two-step authentication, least privilege, and an administration access restriction.
- Add measured login rate limiting or a WAF rule set while watching REST, XML-RPC, cron, upload, and webhook behavior.
- Verify logs, alerts, independent backups, and a restoration procedure.
- Run the full front-end, dashboard, API, upload, cron, and proxy test plan after every future change.
This sequence keeps network controls, application controls, and recovery controls working together. Nginx can prevent many dangerous requests from reaching PHP, but only maintained software, protected identities, careful permissions, and a tested recovery path address the rest of the attack surface.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
