Nginx has become the most popular web server for WordPress hosting. Its event-driven architecture handles concurrent connections efficiently, making it ideal for high-traffic WordPress sites. Proper Nginx configuration can significantly improve performance and security compared to default settings.
This guide covers how to configure Nginx for optimal WordPress performance.
Basic Server Block
The Nginx server block (virtual host) defines how requests are handled for your WordPress site. Configure the server_name directive for your domain, root for the WordPress installation directory, and index to specify index.php as the default file. Include the location blocks that handle PHP processing, static files, and deny access to sensitive files.
Use separate server blocks for HTTP and HTTPS. Redirect HTTP to HTTPS in the HTTP block.
PHP Processing
Configure Nginx to pass PHP requests to PHP-FPM. Use a location ~ \.php$ block to match PHP file requests. Set fastcgi_pass to your PHP-FPM socket or TCP address. Include standard FastCGI parameters. Set high enough values for max_execution_time and max_input_vars for WordPress compatibility.
Use a separate location for processing WordPress admin requests if your admin area needs different PHP settings.
Static File Caching
Cache static files — CSS, JavaScript, images, fonts — with long expiration times. Add a location block for static files with expires and add_header directives. Set expires max for files with versioning in the URL. Add Cache-Control headers for CDN compatibility. Enable gzip compression for text-based static files.
Configure Nginx to bypass PHP processing for static files that exist on disk.
Security Rules
Add Nginx rules to block malicious requests. Deny access to wp-config.php, readme.html, and other sensitive files. Block requests to dot-files and directories. Limit request methods to GET, POST, and HEAD. Block requests with suspicious query strings. Restrict access to wp-admin and wp-login.php by IP if possible.
Add rate limiting to login endpoints to prevent brute force attacks.
SSL Configuration
Configure SSL/TLS for HTTPS access. Use a strong SSL configuration with modern TLS versions. Enable HTTP/2 for improved performance. Redirect all HTTP traffic to HTTPS. Use HSTS headers to enforce HTTPS. Configure SSL session caching for performance. Use Let’s Encrypt for free SSL certificates with auto-renewal.
Test your SSL configuration with SSL Labs after setup.
Il punto fondamentale
Nginx configuration significantly impacts WordPress performance and security. Set up proper server blocks with HTTPS, configure PHP-FPM processing, cache static files aggressively, add security rules, and configure SSL properly. A well-optimized Nginx setup handles high traffic efficiently and protects against common attacks.
