Extra NGINX Directives

ivansalloum

Hey everyone,

I've added some extra NGINX directives to the vhost file to boost security for WordPress and NGINX, along with SSL, as the default SSL configuration only gives you a B score on SSL Labs.

######
## WordPress Security
######

location = /wp-config.php {
    deny all;
}

location = /wp-config.txt {
    deny all;
}

location = /xmlrpc.php {
    deny all;
}

location = /wp-config-sample.php {
	deny all;
}

location = /install.php {
	deny all;
}

location = /upgrade.php {
	deny all;
}

# Return 403 forbidden for readme.(txt|html) or license.(txt|html) or example.(txt|html)
location ~* "/(^$|readme|license|example|legalnotice|installation|changelog)\.(txt|html|md)" {
    deny all;
}

# Deny/Block some extensions
location ~* ^.+\.(7z|asc|asp|aspx|ba|bak|bash|bat|bin|bz2|c|cfg|cgi|class|com|conf|cpp|crt|cs|dat|db|dbf|deb|der|dll|dmg|dmp|dump|ear|exe|git|gz|h|hg|hqx|img|ini|iso|jar|jsp|log|mdb|msi|msm|msp|old|orig|original|out|pem|php#|php_bak|php~|pkg|pl|ppk|py|rar|rdf|rpm|run|save|sh|sql|srv|svn|swo|swp|sys|tar|taz|tcl|tgz|tk|tmp|tpl|tz|vb|war|wsf|z|zip)$ {
    deny all;
    access_log off;
    log_not_found off;
}

# Deny hidden (dot) files except the "well-known" folder
location ~* /.well-known.*/$ {autoindex off;}
location ~* ^\/\.(?!(well-known/)).*$ {
    deny all;
    access_log off;
    log_not_found off;
}

# Disallow php in upload folder
location /wp-content/uploads/ {
    location ~* \.php$ {
            deny all;
    }
}

######
## NGINX Changes
######

server_tokens off;
error_log /var/www/d31c3546-5260-4a66-984d-b07ebe5e6648/nginx_error_log/error.log;

######
## SSL Enhancements 
######

ssl_session_cache shared:SSL:20m;
ssl_session_timeout 180m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_session_tickets off;

elcapitanph

sorry where did you added this ?

ivansalloum

elcapitanph If you are using NGINX, you could go to the websites tab as the owner or super admin and override website‘s settings. At the end of the page, you could edit the vhost file and add extra NGINX directives.

elcapitanph

ivansalloum HMmm sorry i can't see the vhost 🙁 i'm using nginx too

ivansalloum

Update for blocking direct access to php files in specified directories:

# Disallow php in wp-content folder
location /wp-content/ {
    location ~* \.php$ {
            deny all;
    }
}

# Disallow php in wp-includes folder
location /wp-includes/ {
    location ~* \.php$ {
            deny all;
    }
}

# Disallow php in uploads folder
location /uploads/ {
    location ~* \.php$ {
            deny all;
    }
}

# Disallow php in files folder
location /files/ {
    location ~* \.php$ {
            deny all;
    }
}

ivansalloum

Assets Caching:

######
## Cache Assets
######

# Caches images, icons, video, audio, HTC, etc.
location ~* \.(?:jpg|jpeg|gif|png|webp|ico|cur|gz|svg|mp4|mp3|ogg|ogv|webm|htc)$ {
        add_header Cache-Control "public, no-transform";
        expires 1y;
        access_log off;
}

# Cache svgz files, but don't compress them.
location ~* \.svgz$ {
        add_header Cache-Control "public, no-transform";
        expires 1y;
        gzip off;
        access_log off;
}

# Cache CSS and JavaScript.
location ~* \.(?:css|js)$ {
        add_header Cache-Control "public, no-transform";
        expires 1y;
        access_log off;
}

# Cache WebFonts.
location ~* \.(?:ttf|ttc|otf|eot|woff|woff2)$ {
        add_header Cache-Control "public, no-transform";
        expires 1y;
        access_log off;
}

elcapitanph

ivansalloum Thank you so much for your help

ivansalloum

elcapitanph You're very welcome!