Secure the stack in layers: patch every component, route WordPress through PHP-FPM, block executable uploads and hidden files, enforce HTTPS, isolate phpMyAdmin, add authentication and network controls to management paths, rate-limit login endpoints, monitor logs, and maintain encrypted tested backups. Apply changes in staging first, validate the Nginx configuration, then reload rather than restarting blindly.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a secure deployment should achieve
Nginx is the public gatekeeper, PHP-FPM executes trusted PHP, WordPress supplies the application, and phpMyAdmin is a high-value database management interface. A compromise in any one layer can expose the others, so no single directive is sufficient.
As an Amazon Associate I earn from qualifying purchases.
| Layer | Primary risk | Controls |
|---|---|---|
| Operating system and packages | Known vulnerabilities and abandoned software | Inventory versions, patch promptly, remove unused components, monitor security advisories |
| Nginx and document root | Source disclosure, traversal, or execution of uploaded files | Reviewed server block, PHP-FPM upstream, dotfile denial, upload-directory PHP denial |
| Transport | Credential theft and protocol downgrade | Valid TLS certificate, HTTP-to-HTTPS redirect, HSTS after all required hosts support HTTPS |
| Administration | Brute force and stolen credentials | WordPress SSL enforcement, Basic Authentication or IP allowlists, rate limits, WAF rules |
| Database tooling | Direct database takeover through phpMyAdmin | Cookie authentication, no setup/test interfaces, HTTPS, network restriction, limited exposure |
| Recovery and detection | Irrecoverable tampering or unnoticed attacks | Encrypted independent backups, integrity records, access/error-log review, restore exercises |
WordPress Developer Resources strongly recommends HTTPS for logins and visitors. phpMyAdmin documentation advises HTTPS-only service and preferably HSTS, while OWASP recommends authentication, HTTPS, and network restrictions for web-based database tools.
1. Inventory, patch, and remove unnecessary components
Write down the running versions of WordPress, every plugin and theme, PHP, Nginx, phpMyAdmin, the operating system, and any reverse proxy or CDN in front of Nginx. Record which hostnames reach WordPress and which reach phpMyAdmin. This inventory tells you what must be patched and prevents a forgotten management endpoint from escaping the security plan.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Update the application supply chain
- Install WordPress only from the official WordPress distribution at wordpress.org.
- Update WordPress core, plugins, themes, PHP, Nginx, and phpMyAdmin through their supported release channels.
- Remove abandoned plugins, themes, sample files, and unused virtual hosts instead of merely hiding them.
- Subscribe to phpMyAdmin security announcements and track relevant CVEs. A version that is current today can become vulnerable after a newly disclosed issue.
Make a maintenance window and keep a tested rollback or snapshot before major upgrades. A package that cannot be updated safely is a risk that should be removed or isolated.
2. Build a defensive Nginx server block
Use a reviewed server block that sends only intended PHP requests to PHP-FPM. Keep the document root limited to the WordPress installation and avoid broad handlers that execute any file ending in .php anywhere below it.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPass WordPress PHP to PHP-FPM
The exact socket or TCP address depends on the installed PHP version. Replace the example socket with the one present on your system, and keep the FastCGI parameters supplied by your distribution.
upstream wordpress_php {
server unix:/run/php/php-fpm.sock;
}
server {
listen 443 ssl;
server_name example.com www.example.com;
root /var/www/wordpress;
index index.php;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass wordpress_php;
}
}try_files $uri =404 prevents Nginx from passing a nonexistent script name to PHP-FPM. Keep the PHP-FPM pool itself least-privileged: it should have the file access WordPress requires, not unrestricted access to the whole server.
Deny hidden files and directories
Dotfiles can contain credentials, version-control metadata, deployment notes, or editor backups. Permit the ACME challenge directory only if you use it for certificate issuance; deny other hidden paths.
location ~ /.(?!well-known) {
deny all;
access_log off;
log_not_found off;
}This rule is a backstop, not a substitute for removing secrets from the document root. Never store database dumps, private keys, environment files, or backup archives under a web-served directory.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Prevent PHP execution in uploads
WordPress media directories should contain user-uploaded data, not executable application code. Explicitly reject PHP requests below the uploads path.
location ~* ^/wp-content/uploads/.*.php$ {
deny all;
}
location ~* ^/wp-content/blogs.dir/.*/files/.*.php$ {
deny all;
}The second pattern covers a common legacy multisite files layout. If your multisite uses the rewritten /files/ path, add an equivalent denial for that path after confirming the URL structure in staging. Do not assume a single pattern protects every multisite configuration.
Validate and reload safely
- Run
nginx -tand stop if it reports an error. - Check the rendered configuration with
nginx -Twhen you need to confirm which server block and location actually win. - Reload with your service manager, for example
systemctl reload nginx, so existing connections are not cut off unnecessarily. - Request a normal page, a known PHP page, a nonexistent PHP path, a dotfile path, and a PHP-looking file in uploads. Confirm expected status codes in access logs.
Location precedence matters. A broad regular-expression PHP location can override an intended prefix location, so inspect the complete configuration rather than judging an isolated snippet.
3. Establish TLS before forcing HTTPS
Install a valid certificate for every hostname that should serve WordPress or phpMyAdmin. Test the HTTPS virtual host first, then redirect HTTP traffic. Include alternate names only when they are genuinely used; an unused hostname still increases certificate and DNS management.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Enable HSTS only after every intended hostname and subdomain is reliably HTTPS-ready. A typical policy is:
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains' always;HSTS tells browsers not to retry HTTP, so applying includeSubDomains before auditing mail, APIs, staging names, and other subdomains can make those services unreachable. Do not add preload-related settings unless you have separately verified the permanent operational requirements.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Force encrypted WordPress administration
In wp-config.php, use WordPress’s built-in constant:
define( 'FORCE_SSL_ADMIN', true );Place it before the file’s “stop editing” comment and ensure the site URL, proxy, and Nginx scheme agree. If TLS terminates at a trusted reverse proxy, WordPress must receive an accurate HTTPS indication; otherwise it can create redirect loops or issue insecure cookies. Configure proxy headers only for known, trusted proxy addresses and verify the behavior in staging.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Lock down phpMyAdmin
phpMyAdmin should be treated as a private administration tool, not a public feature of the website. A separate hostname or a private management network is preferable when your architecture supports it. If it must share Nginx, keep its location narrow and apply an additional control layer.
Remove installation and diagnostic surfaces
- Delete phpMyAdmin’s
setupand test directories after installation. - Deny direct requests to auxiliary
libraries/andtemplates/files unless the packaged configuration explicitly requires a particular public asset. - Disable
display_errorsin production so paths, SQL statements, and configuration details are not returned to visitors. - Do not leave SQL dumps, configuration backups, or installer archives beside the application.
Use cookie authentication
Prefer phpMyAdmin cookie authentication rather than placing reusable database credentials in a readable configuration file. Protect the cookie secret with appropriate file permissions, rotate credentials when administrators change, and grant database accounts only the privileges they need. A database administrator account exposed through a web interface magnifies the impact of a stolen session.
Add network restrictions
OWASP’s database guidance calls for authentication, HTTPS, and network restrictions around web-based management tools. Restrict phpMyAdmin to a VPN, private subnet, bastion, or a documented administrator IP range whenever possible. An IP allowlist is an additional barrier, not a replacement for strong database and phpMyAdmin authentication; residential and mobile addresses can change, and IP controls can be bypassed after a host compromise.
If you publish phpMyAdmin behind Nginx, combine the network rule with Basic Authentication:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
location ^~ /phpmyadmin/ {
satisfy any;
allow 198.51.100.0/24;
deny all;
auth_basic 'Restricted database administration';
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_pass http://127.0.0.1:8080;
}The example allows the listed network without a second password and requires Basic Authentication for other clients that can reach the location. If you want both controls for every request, remove satisfy any and use the default “all” behavior. Use a dedicated management hostname and confirm that the proxy target cannot be reached directly from the internet.
Keep phpMyAdmin sessions and errors private
Use secure, HTTP-only cookies, a short administrative session lifetime appropriate for your workflow, and generic production error responses. Review phpMyAdmin and Nginx logs for repeated failed logins, requests for removed setup files, and scans of library paths.
5. Protect WordPress management endpoints without breaking the site
Basic Authentication and allowlists
Adding Basic Authentication to all of /wp-admin/ can block legitimate background requests. WordPress uses /wp-admin/admin-ajax.php for many front-end and administrative workflows, and plugins, mobile clients, webhooks, and scheduled jobs may use other endpoints. Before applying a blanket rule, list the integrations you actually use and test each one.
A safer pattern is to protect the interactive administration paths while explicitly deciding how AJAX and API traffic should be handled. For example:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalllocation ^~ /wp-admin/ {
satisfy any;
allow 198.51.100.0/24;
deny all;
auth_basic 'WordPress administration';
auth_basic_user_file /etc/nginx/.htpasswd;
}
location = /wp-admin/admin-ajax.php {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass wordpress_php;
}This is only a starting policy. Leaving AJAX outside the extra challenge reduces friction but means it still relies on WordPress authentication, nonces, capability checks, and rate controls. If a plugin requires authenticated AJAX, protect it in the application rather than assuming an Nginx password is compatible.
Rate-limit login and XML-RPC requests
Use Nginx’s request limiting to slow automated guesses before they consume PHP workers. Define zones in the http context:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
limit_req_zone $binary_remote_addr zone=wp_login:10m rate=1r/s;
limit_req_zone $binary_remote_addr zone=wp_xmlrpc:10m rate=1r/s;Apply them to exact endpoints in the server block:
location = /wp-login.php {
limit_req zone=wp_login burst=5 nodelay;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass wordpress_php;
}
location = /xmlrpc.php {
limit_req zone=wp_xmlrpc burst=3 nodelay;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_pass wordpress_php;
}The rates are starting values, not universal answers. Measure normal administrator, application, and integration traffic before tightening them. A site that uses XML-RPC for a legitimate publishing client may need a separate allowlist or a carefully tuned limit; disabling it blindly can break that client. Monitor 429 responses and adjust burst size and rate based on observed demand.
Add WAF pattern detection when appropriate
A web application firewall or ModSecurity with the OWASP Core Rule Set can identify common automated attack patterns that simple rate limits miss. Treat rules as change-controlled code: begin in detection mode, review false positives, then block narrowly. Keep Nginx limits, WordPress authorization, and patching in place even when a WAF is present.
Recommended Free Tools
6. Reduce information exposure and watch the logs
Return generic errors to the public while preserving useful details in protected logs. Do not expose Nginx version strings, PHP warnings, stack traces, database errors, or filesystem paths in production responses. Keep access and error logs long enough to investigate incidents, and send copies to storage that an intruder on the web server cannot silently rewrite.
Events worth alerting on
- Repeated failures at
wp-login.php,xmlrpc.php, or the phpMyAdmin login. - Requests for dotfiles, backup archives, setup/test paths, and PHP files under uploads.
- Sudden spikes in 4xx, 5xx, or 429 responses.
- Unexpected changes to WordPress core, plugin, theme, or phpMyAdmin files.
- Administrative logins from unfamiliar networks or at unusual times.
Logs are evidence, not prevention. Restrict their permissions, synchronize server time, and document who reviews alerts and how an incident is escalated.
7. Back up for recovery, not just compliance
Back up both WordPress files and the MySQL database on a schedule that matches how much data you can afford to lose. Keep copies independently of the web server, encrypt them in transit and at rest, and retain hashes or another integrity record so you can detect corruption or tampering.
- Include
wp-content, the configuration needed to rebuild the site, and a consistent database export. - Use storage credentials that the web process cannot modify or delete.
- Keep more than one recovery point so a compromise discovered late is not copied into every backup.
- Document the restore sequence, including DNS, certificates, PHP extensions, Nginx configuration, file ownership, and database credentials.
Periodically perform a documented restore in a non-production environment and verify that users can log in, media loads, scheduled jobs run, and database records are intact. The cited guidance requires restore capability but does not establish one universal restore frequency; choose an interval appropriate to your change rate and risk.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →8. Roll out changes in a controlled sequence
- Stage and snapshot. Clone the configuration or use a staging host, record current versions, and make a recoverable snapshot.
- Patch and prune. Update supported components, remove abandoned extensions, and delete unused virtual hosts and files.
- Apply Nginx restrictions. Add the PHP-FPM upstream, dotfile denial, upload PHP denial, and exact endpoint locations.
- Enable TLS. Verify certificates and HTTPS behavior, then redirect HTTP. Add HSTS only after the hostname and subdomain audit.
- Force WordPress admin SSL. Add
FORCE_SSL_ADMINand test cookies, redirects, cron, REST clients, and reverse-proxy behavior. - Isolate phpMyAdmin. Remove setup/test material, use cookie authentication, restrict the network, and add Basic Authentication where compatible.
- Throttle and monitor. Tune login/XML-RPC limits, deploy WAF rules in detection mode first, and configure alerts.
- Validate and reload. Run
nginx -t, inspectnginx -T, reload, and exercise normal and blocked requests. - Record the final state. Store the approved configuration, allowlisted networks, recovery steps, and rollback instructions in a protected change record.
Troubleshooting common lockouts
| Symptom | Likely cause | Check and recovery |
|---|---|---|
| Redirect loop after enabling HTTPS | Reverse proxy scheme is not trusted or WordPress URL settings disagree | Inspect forwarded-protocol handling, ensure only the trusted proxy can set it, then test direct and proxied requests. |
| Administrators receive 401 responses in the dashboard | Basic Authentication covers a required AJAX or integration path | Review the blocked URI, create a deliberate exception or move authorization into WordPress, and retest the workflow. |
| Uploads return 403 for PHP-looking names | The upload execution denial is working | Keep the denial; rename or remove an incorrectly uploaded executable rather than weakening the rule. |
| Legitimate publishing client receives 429 from XML-RPC | Rate limit is below the client’s burst pattern | Identify the client, narrow its allowlist if appropriate, and tune the zone while preserving a limit for other addresses. |
| phpMyAdmin assets fail after a location change | Alias, proxy path, or auxiliary-file denial does not match the packaged layout | Compare the deployed directory structure with the Nginx location, expose only required assets, and keep setup/test paths blocked. |
| Nginx reload fails | Syntax error, duplicate directive, or invalid certificate path | Run nginx -t, correct the reported file and line, and do not replace the running configuration until the test passes. |
Choosing a hosting or deployment arrangement
When evaluating a managed service, VPS image, container platform, or self-managed server, ask for concrete capabilities rather than a generic “secure” label.
| Capability | Questions to ask |
|---|---|
| TLS and HSTS | Can every required hostname use current certificates, redirects, and carefully staged HSTS? |
| Network controls | Can you apply IP allowlists, private networking, VPN access, and Basic Authentication to phpMyAdmin and administration paths? |
| Traffic controls | Are Nginx rate limits, WAF rules, or OWASP CRS configurable without waiting for a vendor change? |
| Version control | Can you choose and patch Nginx, PHP-FPM, WordPress, and phpMyAdmin versions promptly? |
| Backups | Are backups encrypted, independently stored, integrity-checked, and restorable to a separate environment? |
| Notifications | How are package vulnerabilities, phpMyAdmin advisories, and emergency patches communicated? |
| Observability | Can you export access/error logs and receive alerts for authentication failures, blocked paths, and abnormal status codes? |
Bottom line
A hardened Nginx deployment does not rely on obscurity or one firewall rule. Keep the software current, make PHP execution explicit, block hidden and uploaded executables, encrypt every administrative session, place phpMyAdmin behind authentication and network restrictions, throttle abuse without breaking required WordPress workflows, and prove that encrypted backups can restore the site. Re-test those controls after every application, proxy, or configuration change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
