Run NGINX on the public-facing server and use proxy_pass to send each HTTP request to the other server that hosts WordPress. The backend web server must execute PHP through its own local PHP-FPM or Apache/PHP stack; the front NGINX should not try to connect to a PHP-FPM socket that exists on the backend. Forward the original host, client address, and protocol so WordPress can generate correct links and avoid HTTPS redirect loops.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the finished arrangement looks like
A reverse proxy is an HTTP relay. NGINX accepts the browser request, sends it to a specified upstream server, receives the upstream response, and returns that response to the browser. In this design, the public server owns the DNS name and normally terminates TLS, while the private or restricted server owns the WordPress files, database connection, web server, and PHP runtime.
As an Amazon Associate I earn from qualifying purchases.
| Layer | Public proxy server | WordPress backend server |
|---|---|---|
| Internet listener | NGINX listens on the public HTTP and/or HTTPS ports. | Not exposed directly to the Internet unless there is a specific operational reason. |
| Request protocol | Uses proxy_pass to speak HTTP to the backend. |
Receives an HTTP request from the proxy and serves WordPress. |
| PHP execution | Does not need the backend’s PHP-FPM socket. | The local NGINX or Apache instance invokes local PHP-FPM or its local PHP handler. |
| Canonical hostname | Publishes the site’s real hostname. | Receives that hostname in the forwarded Host header. |
| TLS | Can terminate HTTPS and forward the original protocol. | Can speak HTTP internally when the proxy and network are trusted. |
The backend firewall should allow its application listener only from the proxy’s address or network. Use a stable backend hostname or IP, and open only the HTTP port that the proxy actually needs.
Prerequisites before changing NGINX
- A DNS name such as
example.comresolves to the public proxy server. - The proxy host can reach the backend’s HTTP address and port over the network.
- WordPress works when requested directly from the proxy host, using the backend’s intended hostname and path.
- The backend web server already knows how to serve WordPress and invoke its local PHP-FPM or Apache/PHP handler.
- The backend firewall permits the proxy and rejects unintended sources.
- You have administrative access to validate and reload NGINX on the proxy and to inspect the backend web-server and WordPress logs.
Test the backend independently first. If the backend returns an error when reached from the proxy host, adding another NGINX layer will hide the original problem rather than fix it.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Minimal reverse-proxy server block
Put a public server block in the proxy’s NGINX configuration. Replace WORDPRESS_BACKEND with a backend hostname or IP address; add a port when the backend is not using the default HTTP port.
server {
listen 80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://WORDPRESS_BACKEND;
}
}The proxy_pass value is an HTTP endpoint, not a PHP-FPM endpoint. NGINX accepts a domain or IP and may include a port. The proxy sends the request to that address, waits for the backend response, and returns it to the client.
Free tools Windows power users keep installed
One-click scans. No signup required.
What each directive contributes
| Directive | Purpose | Why WordPress needs it |
|---|---|---|
server_name |
Selects this virtual server for the public hostname. | Lets the proxy serve the same domain that WordPress uses for canonical URLs. |
location / |
Matches the site’s ordinary requests. | Passes pages, feeds, media, login requests, and static assets to the backend. |
proxy_set_header Host $host |
Replaces the upstream host header with the public host. | Prevents the backend from constructing links to an internal name or address. |
X-Real-IP |
Passes the immediate client address. | Gives backend applications a useful client address for logs and access rules. |
X-Forwarded-For |
Appends the client address to the forwarding chain. | Preserves proxy history when more than one trusted proxy is present. |
X-Forwarded-Proto |
Reports the protocol seen by the public proxy. | Allows WordPress to distinguish an original HTTPS request from internal HTTP. |
proxy_pass |
Defines the backend HTTP destination. | Moves request processing to the server that hosts WordPress and PHP. |
NGINX changes some upstream headers, including Host and Connection, by default. Explicitly setting the host and forwarding headers is therefore part of the working configuration, not cosmetic cleanup.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Decide whether proxy_pass should contain a URI
The location of a trailing path in proxy_pass changes URI handling. When the directive includes a URI, NGINX replaces the portion of the request URI that matched the location. Without a URI, NGINX passes the original or normalized request URI to the backend.
| Configuration shape | Effect | Typical risk |
|---|---|---|
location / { proxy_pass http://backend; } |
Preserves the requested path while forwarding it. | Usually the least surprising choice when the backend WordPress site is installed at the domain root. |
location / { proxy_pass http://backend/some-path/; } |
Replaces the matched part with the specified URI. | Can duplicate, remove, or shift path segments if the backend expects a different root. |
Choose the form that matches the backend’s real document root and site URL. A mistaken slash or path can break pretty permalinks, images, JavaScript, CSS, or the login URL. After every URI change, request the homepage, a known post, a media file, and /wp-admin/.
Keep PHP on the WordPress server
proxy_pass speaks HTTP. fastcgi_pass speaks FastCGI and is intended for a PHP-FPM service. If PHP-FPM is running on the WordPress server, the backend’s own NGINX or Apache configuration should send PHP scripts to its local socket or local FastCGI listener.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Do not configure the public proxy with a path such as fastcgi_pass unix:/run/php/...sock when that socket exists only on the backend. A Unix socket is local to the machine that owns it. The front server cannot use it merely because the two machines are connected by a network.
Request path through both servers
- A browser requests
https://example.com/about/. - The public NGINX terminates TLS, records that the original scheme was HTTPS, and proxies an HTTP request to the backend.
- The backend NGINX or Apache maps the path to WordPress.
- If WordPress needs PHP, the backend web server invokes its local PHP-FPM or PHP handler.
- The backend returns HTML, a redirect, an error, or an asset response to the public NGINX.
- The public NGINX sends that response back over the client connection.
Configure WordPress for the public hostname
WordPress must be configured for the same public domain that users enter. The backend should receive Host: example.com (or the requested public host) rather than an internal address. This is especially important for absolute links, canonical redirects, login forms, feeds, and media URLs.
Because NGINX has no directory-level equivalent of Apache’s .htaccess, WordPress cannot automatically write rewrite rules into a per-directory file. Put rewrite, access-control, upload-size, and caching rules in the relevant NGINX server configuration, or configure them on the backend web server. Pretty permalinks therefore depend on explicit server rules and correct forwarding.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Check the site’s URL assumptions
- Verify the WordPress home and site URLs use the public hostname.
- Remove accidental references to the backend’s private hostname or IP.
- Confirm that the backend does not redirect the public host to an internal name.
- Check that the login and administration paths remain under the intended public host.
Terminate HTTPS at the proxy without creating a redirect loop
A common arrangement is HTTPS from the browser to the public NGINX and HTTP from that proxy to the backend. In that arrangement, the backend connection being HTTP does not mean the user’s request was HTTP. The proxy must forward X-Forwarded-Proto $scheme, and WordPress must be configured to trust the forwarded protocol from this trusted proxy.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →WordPress’s HTTPS guidance warns that SSL termination at a reverse proxy can cause an infinite redirect loop when the origin does not receive or honor the original protocol. The loop occurs when WordPress sees the internal HTTP connection, decides the request is insecure, redirects to HTTPS, and then receives another internal HTTP request that it still considers insecure.
Apply the protocol handling deliberately
- Install and validate the certificate on the public NGINX server.
- In the HTTPS server block, keep
proxy_set_header X-Forwarded-Proto $scheme;. - Configure WordPress or its backend integration to treat a trusted
X-Forwarded-Proto: httpsvalue as HTTPS. - Do not trust arbitrary client-supplied forwarding headers when the backend can be reached directly; restrict the backend network so only the proxy can send them.
- Test both
https://example.com/andhttps://example.com/wp-admin/.
Verify that canonical redirects, login redirects, images, stylesheets, and scripts all stay on HTTPS. If the browser reports too many redirects, inspect the value WordPress sees for the protocol and compare it with the proxy’s forwarded header.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Build the production configuration in a controlled sequence
- Prove backend reachability. From the proxy host, request the backend’s HTTP address and confirm that it returns the expected WordPress site rather than a firewall timeout or unrelated virtual host.
- Choose a stable upstream. Use a stable DNS name or IP and document the backend port. Avoid an address that can change without a corresponding configuration update.
- Restrict the firewall. Permit the backend listener only from the proxy’s address or approved proxy network. Keep database and administrative services outside this public path.
- Create the public server block. Set the public
server_name, the matchinglocation /, and the HTTPproxy_passdestination. - Add forwarding headers. Set
Host,X-Real-IP,X-Forwarded-For, andX-Forwarded-Protoexactly for the trust model you use. - Review URI behavior. Decide whether the upstream needs a URI suffix. If WordPress is installed at the backend root, start without one.
- Validate syntax. Run
nginx -ton the proxy. Fix every reported error before reloading. - Reload safely. Reload NGINX using the service-management method for your operating system, such as
systemctl reload nginx, so existing connections are not needlessly terminated. - Exercise the site. Request the homepage, a pretty-permalink post, a static asset, a media upload, the login page, and
/wp-admin/. - Read both log sets. Correlate the public proxy access/error logs with the backend web-server and PHP logs. A 502 at the proxy can represent a backend refusal, timeout, wrong port, or crashed backend service.
Troubleshoot by symptom
The proxy returns 502 or cannot connect
- Confirm the backend address resolves on the proxy host.
- Confirm the backend is listening on the configured port and on an address reachable from the proxy.
- Check the backend firewall for the proxy’s source address.
- Check whether the upstream service is down or whether the configured port is HTTPS while
proxy_passuses HTTP, or vice versa. - Inspect the proxy error log and the backend listener log at the same timestamp.
Every URL points to the private hostname
- Ensure the proxy sets
Host $host. - Check WordPress’s configured home and site URLs.
- Look for backend redirects that replace the public host.
HTTP and HTTPS keep redirecting each other
- Confirm the HTTPS-facing proxy sends
X-Forwarded-Proto https. - Configure WordPress to recognize that trusted forwarded value.
- Ensure only the proxy can reach the backend, so an untrusted client cannot forge the header.
- Clear browser redirect caches only after the server-side protocol logic is corrected.
Pretty permalinks return 404
- Check that the proxy is forwarding the original path and has no unintended URI suffix.
- Check the backend web server’s WordPress rewrite rules; an
.htaccessfile on a front NGINX server will not provide directory-level behavior. - Compare a direct backend request with the same path through the public hostname.
CSS, JavaScript, images, or uploads fail
- Inspect the browser’s requested URL and verify the public host and path are preserved.
- Check URI replacement in
proxy_pass. - Review backend access and error logs for missing files or rejected upload sizes.
- Put upload-size and caching rules in the appropriate NGINX or backend configuration rather than expecting WordPress to edit NGINX automatically.
Logs show the proxy address instead of the visitor
Ensure the forwarding headers are present and that the backend logging or application layer is configured to use them only from a trusted proxy. X-Forwarded-For is a chain, so blindly accepting a client-supplied value is unsafe when the backend is directly reachable.
Choose the right deployment arrangement
| Arrangement | Where TLS terminates | PHP-FPM relationship | Firewall boundary | Operational complexity | Failure impact |
|---|---|---|---|---|---|
| Direct backend exposure | On the backend web server. | Local to the web server that invokes it. | One Internet-facing application host. | Lowest number of moving parts. | A backend outage is immediately a public outage; fewer layers make diagnosis simpler. |
| Single-server NGINX and PHP-FPM | On the same server as WordPress, unless another edge is added. | Local Unix socket or local FastCGI listener. | One host can contain web, PHP, and WordPress controls. | Usually simpler than a split deployment. | Web-server, PHP, and application failures share one machine. |
| Two-server reverse proxy | Usually on the public NGINX server. | Local to the backend web server, never assumed to be local to the proxy. | Backend listener can be restricted to the proxy. | Requires header, URI, firewall, certificate, and log coordination. | The site depends on both proxy and backend; either unavailable component can prevent service. |
The two-server design is useful when you need a separate public edge, an isolated application host, or a firewall boundary. It is not automatically faster or simpler. The extra hop adds configuration and another failure point, so document the upstream address, trust relationship, TLS termination point, and recovery procedure.
Quick Recap
Security and maintenance decisions
- Limit reachability: expose the backend application port only to the proxy wherever possible.
- Protect forwarding headers: treat protocol and client-address headers as trustworthy only when they arrive through a controlled proxy path.
- Keep hostnames consistent: use the public host for WordPress’s canonical settings and for the forwarded
Hostheader. - Separate responsibilities: the proxy handles public connection policy and forwarding; the backend handles WordPress rewrites, PHP execution, uploads, and application responses.
- Reload after validation: use
nginx -tbefore every reload and retain the previous known-good configuration for rollback. - Monitor both machines: a healthy proxy process does not prove that the backend web server or PHP runtime is healthy.
Final verification checklist
- The public DNS name reaches the proxy.
- The proxy reaches the backend on the intended HTTP port.
- The backend serves WordPress correctly when requested from the proxy host.
proxy_passpoints to an HTTP endpoint, not a remote PHP-FPM socket.Host,X-Real-IP,X-Forwarded-For, andX-Forwarded-Protoare set.- The URI form of
proxy_passmatches the backend’s WordPress path. - WordPress uses the public hostname and recognizes HTTPS when TLS terminates at the proxy.
- Pretty permalinks, assets, media, login, and
/wp-admin/work through the public name. nginx -tsucceeds before reload, and both proxy and backend logs are available for diagnosis.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
