PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA reliable WordPress HTTPS setup on Nginx uses two server blocks: port 80 remains available for ACME certificate challenges and redirects ordinary requests to one canonical HTTPS hostname; port 443 terminates TLS and sends WordPress PHP requests to PHP-FPM. The configuration below includes pretty-permalink routing, protected files, modern TLS versions, static-file handling and the checks needed before reload.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What this configuration does
The design separates responsibilities instead of trying to make one server block handle every case. The HTTP listener on port 80 answers both IPv4 and IPv6 requests. It leaves /.well-known/acme-challenge/ available for certificate issuance and renewal, then sends all other paths to the chosen HTTPS hostname with a single permanent redirect. The TLS listener on port 443 serves the WordPress document root, terminates TLS, routes pretty permalinks through index.php, and hands PHP scripts to PHP-FPM.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Replace every deployment-specific value before using the example: example.com, www.example.com, /var/www/example.com, the ACME webroot, certificate paths and the PHP-FPM socket. A socket copied from another server is a common cause of a site that returns 502 errors.
Prerequisites and decisions to make first
- DNS for each hostname in
server_namemust point to this Nginx host. If you do not intend to servewww, remove it from the names and establish a separate redirect policy. - The WordPress files must exist under the configured
root, and Nginx must be able to read them. PHP-FPM must be installed, running and able to read the same files. - Choose one canonical HTTPS hostname, such as
https://example.com. The port-80 redirect below sends both names to that hostname; change it ifwwwis canonical instead. - Decide where the ACME client will place HTTP-01 challenge files. The example uses
/var/www/certbot. That directory must be writable by the certificate client and readable by Nginx. - Find the actual PHP-FPM endpoint. On a Unix-socket installation it may include a versioned path such as
/run/php/php8.x-fpm.sock; on another host it may be a TCP address such as127.0.0.1:9000.
Do not enable long-lived HSTS for a hostname until every hostname covered by the policy is already working over HTTPS. A mistake in HSTS can make browsers refuse HTTP recovery for the policy lifetime.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Complete Nginx configuration
Place the equivalent of these server blocks in the site configuration loaded by Nginx. The comments explain the security and routing choices.
# HTTP: keep ACME validation available, redirect everything else
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location ^~ /.well-known/acme-challenge/ {
root /var/www/certbot;
default_type text/plain;
try_files $uri =404;
}
location / {
return 301 https://example.com$request_uri;
}
}
# HTTPS WordPress site
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
root /var/www/example.com;
index index.php index.html;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# Enable only after every covered hostname is HTTPS-ready.
add_header Strict-Transport-Security "max-age=31536000" always;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
try_files $uri =404;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTPS on;
fastcgi_pass unix:/run/php/php-fpm.sock;
}
location ~* /(?:.ht|wp-config.php|readme.html|license.txt) {
deny all;
}
location ~* .(css|js|jpg|jpeg|png|gif|svg|webp|ico|woff2?)$ {
expires 7d;
access_log off;
try_files $uri =404;
}
}The socket in this listing is intentionally generic. Check the PHP-FPM pool configuration and service status, then substitute the real endpoint. Do not use the obsolete ssl on; directive; current Nginx enables TLS with the ssl parameter on listen 443.
How request routing works
Port 80 and ACME validation
The ^~ prefix gives the ACME location precedence over regular expression locations. A request for a challenge file is mapped below /var/www/certbot; try_files returns 404 if the file is absent instead of passing the request to WordPress. Every other HTTP path receives a 301 redirect while preserving the original path and query string through $request_uri.
Keep port 80 open during both initial issuance and renewal. Redirecting the challenge location, blocking it with authentication, or serving it from a different webroot causes HTTP-01 validation to fail.
Pretty permalinks
The HTTPS location / first serves an existing file or directory. If neither exists, Nginx internally routes the request to /index.php and preserves the query string. This is the front-controller pattern WordPress needs for pages, posts and other pretty URLs.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
PHP-FPM handoff
The PHP regular-expression location handles files ending in .php. Its initial try_files $uri =404; prevents Nginx from sending a nonexistent script to PHP-FPM. fastcgi_params passes request metadata, while SCRIPT_FILENAME gives PHP-FPM the filesystem path to execute. HTTPS on tells WordPress and PHP that the request arrived securely, avoiding incorrect HTTP URL generation when TLS terminates at this Nginx process.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteFinding and setting the PHP-FPM endpoint
- Identify the installed PHP-FPM service and its pool configuration. The pool’s
listensetting is the authoritative socket or TCP address. - Confirm that the Nginx master process can connect to a Unix socket. Socket ownership and group permissions must allow the Nginx worker account to use it.
- Substitute the exact value in
fastcgi_pass. For a socket, retain theunix:prefix; for TCP, use the configured host and port. - Restart or reload PHP-FPM if its pool was changed, then run an Nginx configuration test before reloading Nginx.
If PHP-FPM is running but Nginx reports “connect() to unix socket failed,” inspect the socket path, service version, ownership and mandatory-access-control policy. A 502 response generally indicates this handoff problem rather than a WordPress routing error.
Obtaining and renewing the certificate
Back up the Nginx site configuration before allowing an ACME client to make automated edits. Whether you use Certbot’s Nginx integration or another lifecycle tool, the validation requirement is the same: the authority must be able to fetch a token over HTTP from each requested hostname.
- Create the ACME webroot directory and ensure the Nginx worker can read it.
- Install the port-80 server block with the dedicated challenge location. Test that a temporary file under
/.well-known/acme-challenge/is returned as plain text. - Request a certificate for every hostname you intend to serve. The resulting certificate and key paths must match the
ssl_certificateandssl_certificate_keydirectives. - Run
nginx -t. Fix syntax errors, missing files and permission errors before any reload. - Reload Nginx gracefully so existing connections finish while workers adopt the certificate.
- Test the canonical HTTPS URL, the alternate hostname policy and an actual renewal run. Confirm that renewal is followed by a successful configuration test and reload.
The certificate directive normally points to a full chain file, while the private-key directive points to the private key. Protect that key so only the account and Nginx master process that require it can read it. Do not place the key inside the public WordPress document root.
WordPress HTTPS settings
Once the certificate is valid, set both the WordPress Address and Site Address to the same canonical https:// URL in the WordPress administration screen. This changes generated links, canonical tags and form destinations. If administration is locked to HTTPS by configuration constants, use the documented HTTPS administration constants appropriate to your deployment.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Change the addresses only after the TLS virtual host works. Otherwise you can lock the dashboard to a URL that currently produces a certificate or routing error. After saving, clear any application or page cache and check that images, stylesheets and scripts load over HTTPS; mixed-content warnings often reveal hard-coded HTTP URLs in themes, plugins or stored content.
Reverse-proxy deployments
If another proxy or load balancer terminates TLS before this Nginx server, the proxy must forward the original protocol consistently and Nginx/PHP must trust that signal. Without a correct forwarded-protocol arrangement, WordPress may generate HTTP links or repeatedly redirect between HTTP and HTTPS. The exact directive depends on the proxy topology, so do not copy a proxy setting from an unrelated deployment.
Security choices in the server block
TLS versions and session settings
ssl_protocols TLSv1.2 TLSv1.3; excludes older protocol versions. The shared 10 MB session cache and 10-minute timeout are operational defaults, not a performance guarantee; adjust them only when you understand the connection volume and Nginx build in use.
Protected files
The deny location blocks Apache configuration files, wp-config.php and public documentation files commonly used for fingerprinting. Keep this restriction even if filesystem permissions are also tight. Review additional sensitive files introduced by your deployment or plugins.
Static assets
The static-file location returns only files that actually exist, disables access logging for those requests and supplies a seven-day client expiry. It covers common CSS, JavaScript, image, icon and font extensions. Add other extensions only when you understand their contents and caching behavior.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
HSTS timing
The shown header applies a one-year policy to HTTPS responses. Enable it only after every covered hostname is HTTPS-ready. Do not add includeSubDomains until every subdomain can serve HTTPS; one forgotten subdomain can become unreachable in browsers that honor the policy.
FastCGI caching: useful, but not a starting default
The configuration deliberately omits FastCGI caching. Caching anonymous HTML can reduce PHP work, but an unsafe cache can expose one visitor’s page, stale login state or a submitted form to another visitor. Begin with caching disabled and add it only after observing the site’s plugins and request patterns.
A safe design uses an explicit cache zone and bypass rules for at least:
- POST and other state-changing requests.
- Requests with query strings when those parameters affect output.
- Login, administration, preview, feed and XML-RPC paths.
- Requests carrying a logged-in or commenting-user cookie.
- Plugin endpoints, carts, account pages and any personalized response.
After enabling a cache, test comments, logins, previews, administrative screens, forms and plugin APIs as separate cases. A cache hit on a public article is not proof that the bypass rules are correct.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing common deployment variants
| Decision | Option | When it fits | Main caution |
|---|---|---|---|
| Site layout | Single-site WordPress | One installation and one document root | Use the exact hostname and root for that site. |
| Site layout | Multisite | Several WordPress sites sharing an installation | Hostname mapping, upload paths and rewrite rules need a multisite-specific review. |
| PHP-FPM transport | Unix socket | PHP-FPM runs on the same host | Socket path and permissions must match the active pool. |
| PHP-FPM transport | TCP upstream | PHP-FPM is isolated on another service or host | Secure the network path and use the configured address and port. |
| TLS termination | Directly in Nginx | Nginx owns certificates and serves the site | Renewal must reload Nginx successfully. |
| TLS termination | Reverse proxy or load balancer | A front-end service owns the public certificate | Forwarded protocol and client metadata must be trusted and consistent. |
| HTML caching | Disabled | Most new or plugin-heavy sites | Higher PHP load is preferable to serving private or stale content. |
| HTML caching | Explicit FastCGI cache | Stable anonymous traffic after testing | Every personalized and state-changing path needs a bypass. |
Validation checklist after every change
- Run
nginx -tand resolve every reported syntax, include-file, certificate-path and permission error. - Reload gracefully, then inspect the Nginx error log for upstream, certificate and filesystem failures.
- Request an HTTP URL and verify exactly one redirect to the selected canonical HTTPS hostname, with its path and query string intact.
- Check the certificate hostname, chain and expiry in a browser or TLS client for both covered names.
- Open the home page, a pretty permalink,
/wp-admin/, a known PHP request and representative CSS, JavaScript, image and font assets. - Verify that
wp-config.php, dot-files and other restricted paths are denied rather than downloaded. - Exercise login, logout, comments, previews and plugin API requests. If caching is enabled, verify each response is bypassed where required.
- Run the renewal workflow and confirm that the renewed certificate is installed and Nginx reloads without downtime or configuration errors.
Troubleshooting by symptom
502 Bad Gateway
Check fastcgi_pass, PHP-FPM service status, socket existence, socket permissions and whether the pool listens on TCP instead. The error log usually identifies a missing socket or refused connection.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
404 for every post or page
Confirm that the HTTPS location / contains try_files $uri $uri/ /index.php?$args;, that the document root is the WordPress root and that the PHP location can execute the resulting script.
Redirect loop
Check the WordPress Address and Site Address, the canonical hostname redirect and any upstream proxy protocol headers. A proxy that terminates TLS but tells WordPress the request is HTTP commonly causes this loop.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Certificate renewal failure
Verify DNS, port-80 reachability, the exact challenge webroot, file permissions and that no location or firewall rule blocks /.well-known/acme-challenge/. Run nginx -t before attempting the reload hook again.
Mixed-content warnings
Search stored content, theme files and plugin settings for absolute HTTP URLs. The Nginx redirect cannot rewrite URLs already embedded in an HTTPS page; update those references and clear relevant caches.
Operational ownership
Record which service owns certificates, which account can read the private key, where the ACME webroot lives and which process performs reloads. Keep a tested rollback copy of the Nginx configuration. A working first issuance is not enough: renewal, reload and WordPress URL generation must continue to work months later when no one is watching the server.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
