Nginx：優化及設定檔記錄

WordPress 固定網址，沒改會跳下載

預設
location / {
}
改為
location / {
            index index.php index.html index.htm;
            try_files $uri $uri/ /index.php?$args;
            rewrite /wp-admin$ $scheme://$host$uri/ permanent;  
    }

HTTP轉HTTPS

server {
    listen 80;
    server_name www.domainname.com;
    if ( $scheme = http ){
    return 301 https://$server_name$request_uri;
    }
}

PHP-FPM設定，把下面第一欄註解拿掉

#    location ~ \.php$ {
#        try_files $uri =404;
#        #fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
#        fastcgi_pass 127.0.0.1:9000;
#        fastcgi_index index.php;
#        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#        include fastcgi_params;
#}

優化

繼續加入在location ~ \.php$ 下
       fastcgi_max_temp_file_size 0;
       fastcgi_buffer_size 4K;
       fastcgi_buffers 32 8k;
       client_max_body_size 500m;
       client_body_buffer_size 1024k;

設定靜態快取

     location ~* \.(jpg|jpeg|png|css|js|webp)$ {
        expires 365d;
        access_log off;
        add_header Cache-Control "public";
        }

設定安全性(要知道自己在做什麼)

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
add_header Access-Control-Allow-Origin https://www.abc.com.tw;
add_header Access-Control-Allow-Origin http://www.abc.com.tw;
add_header X-Frame-Options SAMEORIGIN;
add_header Referrer-Policy "same-origin";
add_header Feature-Policy "geolocation 'none'; camera 'none'; speaker 'none';";

location ~ ^/\.user\.ini {
     deny all;
}
location /xmlrpc.php {
     deny all;
}

隱藏Nginx版本

server_tokens off;

Gzip壓縮，參考來源

gzip on;
gzip_vary on;
gzip_min_length 1k;
gzip_proxied any;
gzip_comp_level 4;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_buffers 4 32k;
gzip_disable "MSIE [1-6].(?!.*SV1)";
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

SSL的部分

ssl_session_cache shared:SSL:1m; # holds approx 4000 sessions
ssl_session_timeout 1h; # 1 hour during which sessions can be re-used.
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_stapling on;
ssl_stapling_verify on;
ssl_buffer_size 4k;

其他

resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;