wordpress

# EasyPath NGINX virtual host configuration
# Customized for PHP/WordPress

server {
	listen 443 ssl http2 default_server;
	listen [::]:443 ssl http2 default_server;

	# PEM contains signed server certificate and chain
	ssl_certificate /webapps/<domain_name>/ssl/<domain_name>.pem;

	# Private key of server certificate
	ssl_certificate_key /webapps/<domain_name>/ssl/<domain_name>.key;

	# Session caching to improve performance
	ssl_session_cache shared:SSL:50m;
	ssl_session_timeout 1d;

	# Turn off session tickets
	ssl_session_tickets off;

	# Sourced from https://cipherli.st
	# Higher security; modify if IE < 9 support on Windows XP is required
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_prefer_server_ciphers on;
	ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

	# DH parameter
	ssl_dhparam /etc/nginx/ssl/dhparam.pem;

	# HSTS
	add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

	# Deters click-jacking
	# Do not set to DENY, otherwise causes issues in WordPress WP-Admin
	add_header X-Frame-Options SAMEORIGIN;
	
	# Deters MIME-type confusion attacks
	add_header X-Content-Type-Options nosniff;

	# OCSP stapling
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_trusted_certificate /webapps/<domain_name>/ssl/ca_chain.pem;

	# Root location
	root /webapps/<domain_name>/public;

	# Add & move index.php to the front of the list for PHP/Wordpress
	index index.php index.html index.htm;

	# Required for WordPress permalinks
	location / {
		try_files $uri $uri/ /index.php?$args;
	}

	# For PHP
	# Pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
	location ~ \.php$ {
		include snippets/fastcgi-php.conf;

		# PHP7.0-FPM
		fastcgi_pass unix:/run/php/php7.0-fpm.sock;
	}

	# Logging
	access_log /webapps/<domain_name>/logs/access.log;
	error_log /webapps/<domain_name>/logs/error.log;

	# Prevent serving files beginning with a “.”
	# Do not log attempt
	location ~ /\. {
		access_log off;
		log_not_found off;
		deny all;
	}

	# Prevent serving files beginning with a “$”
	# Do not log attempt
	location ~ ~$ {
		access_log off;
		log_not_found off;
		deny all;
	}

	# Prevent logging whenever favicon & robots.txt files are accessed
	location = /robots.txt {
		log_not_found off;
	}

	location = /favicon.ico {
		access_log off;
		log_not_found off;
	}
}

# Redirect all HTTP traffic to HTTPS
# Always redirect to www.<domain_name>, not bare-domain (without "www") according to SEO best-practices
server {
	listen 80;
	listen [::]:80;

	return 301 https://www.<domain_name>$request_uri;
}

# Redirect bare-domain HTTPS to https://www.<domain_name>
server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name <domain_name>;
	return 301 https://www.<domain_name>$request_uri;
}