How can I improve performance while enhancing security in Nginx for WordPress

Performance Improvements in Nginx for WordPress

Use Caching Aggressively

- Static Content Caching: Configure Nginx to cache static files like images, CSS, and JavaScript. Use appropriate `expires` and `cache-control` headers to instruct browsers and intermediaries to cache these resources. This reduces repeated server loads and speeds up page load times.

- FastCGI Cache: Utilize Nginx's FastCGI cache to store rendered HTML output of PHP pages. This allows Nginx to serve pages directly without invoking PHP for every request. Configure cache paths, keys, and cache duration judiciously—for example, caching pages for a few minutes to balance freshness and speed.

- Avoid Caching Admin and Dynamic Areas: Disable caching for WordPress admin pages (`/wp-admin/`) and logged-in users, as these need real-time content updates.

Optimize PHP Processing

- Use PHP-FPM with Unix sockets rather than TCP sockets for faster local communication between Nginx and PHP.

- Tune PHP-FPM worker processes and memory limits based on traffic volume.

- Use opcode caching (such as APCu or Zend OPcache) to cache compiled PHP scripts, reducing CPU cycles.

Reduce Requests and Minimize Assets

- Minimize CSS and JavaScript files, combining and compressing them.

- Use lazy loading for images and defer JavaScript to speed up initial page rendering.

- Limit use of WordPress plugins especially those that add numerous or heavy scripts.

Gzip and Brotli Compression

Use HTTP/2 or HTTP/3

Optimize SSL Performance

- Enable SSL session caching to reuse handshake parameters.

- Use OCSP stapling to speed up certificate revocation checks.

- Choose modern, strong cipher suites and protocols (e.g., TLS 1.3).

Security Enhancements in Nginx for WordPress

Enforce HTTPS Everywhere

Security Headers

- Content-Security-Policy (CSP): Restricts resources such as scripts and styles to trusted sources, preventing XSS attacks.

- X-Content-Type-Options: Stops browsers from MIME-type sniffing, reducing attack vectors.

- X-Frame-Options: Prevents clickjacking by restricting framing of pages.

- Referrer-Policy: Controls information sent in the HTTP Referer header to reduce data leakage.

- Strict-Transport-Security (HSTS): Forces browsers to connect only over HTTPS.

Restrict Access to Sensitive Paths and Files

- Deny access to `wp-config.php`, `.htaccess`, readme files, license files, and hidden files.

- Block or restrict access to admin login and backend with IP whitelisting or rate limiting.

Disable XML-RPC

Use Fail2Ban or Rate Limiting

Disable PHP Execution in Uploads

Use ModSecurity or Web Application Firewall (WAF)

Example Nginx Configuration Highlights for WordPress Security and Performance

HTTP to HTTPS Redirect

nginx
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://$host$request_uri;
}

SSL Configuration and OCSP Stapling

nginx
server {
  listen 443 ssl http2;
  server_name example.com;

  ssl_certificate /etc/ssl/certs/example.com.crt;
  ssl_certificate_key /etc/ssl/private/example.com.key;
  
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 1d;
  ssl_session_tickets off;
  
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/ssl/certs/chain.pem;
  
  # Strong SSL protocols and ciphers
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
  ssl_prefer_server_ciphers on;
}

Cache Control for Static Files

nginx
location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff2?|ttf|eot)$ {
  expires 30d;
  access_log off;
  add_header Cache-Control "public";
}

FastCGI Cache for Dynamic Pages

nginx
fastcgi_cache_path /var/cache/nginx/wordpress levels=1:2 keys_zone=WORDPRESS:100m inactive=60m;
fastcgi_cache_key "$scheme$request_method$host$request_uri";

server {
  ...

  location ~ \.php$ {
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
    fastcgi_cache WORDPRESS;
    fastcgi_cache_valid 200 60m;
    fastcgi_cache_use_stale error timeout invalid_header updating http_500;
    fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
    fastcgi_cache_bypass $http_cookie;
    ...
  }
}

Security Headers

nginx
add_header Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval';" always;
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Referrer-Policy no-referrer-when-downgrade always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-XSS-Protection "1; mode=block" always;

Restrict Access to Sensitive Files

nginx
location ~* /(wp-config.php|readme.html|license.txt|error_log|wp-admin/install.php) {
  deny all;
}

Restrict Access to wp-admin and wp-login.php

nginx
location ^~ /wp-admin/ {
  allow 1.2.3.4; # Whitelist your IP here
  deny all;
  try_files $uri $uri/ /index.php?$args;
}

location = /wp-login.php {
  allow 1.2.3.4; # Whitelist your IP here
  deny all;
  include fastcgi_params;
  fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
}

Disable PHP Execution in Uploads

nginx
location ^~ /wp-content/uploads/ {
  location ~ \.php$ {
    deny all;
  }
}

Additional Security and Performance Considerations

- Keep WordPress Core, Themes, and Plugins Updated: Regular updates patch vulnerabilities and improve performance.

- Limit Plugins: Use only necessary and well-maintained plugins to reduce attack surface and keep performance optimized.

- Database Optimization: Optimize database queries, indexing, and clean up unused data.

- Use Object Caching: Set up Redis or Memcached for caching database queries and objects.

- Automate Backups: Schedule regular backups in case of compromise or data loss.

- Monitor and Log: Enable monitoring and logging to detect suspicious activity early.

- Strong Passwords and Two-Factor Authentication: Enforce strong passwords and 2FA for all admin users.