Hi, is there anything special I need to configure on BitFire for an nginx install?
wordpress nginx security
2 postsHi, is there anything special I need to configure on BitFire for an nginx install?
Hi Steve. Ff you’re running WordPress on nginx with BitFire installed, the main things I would still do are:
* Keep WordPress core, plugins, and themes updated.
* Remove unused plugins and themes.
* Use strong, unique administrator passwords.
* Keep automatic, off-server backups and test that they can actually be restored.
* Disable PHP execution inside `/wp-content/uploads/`. (if you have access to your nginx configuration)
* Disable nginx directory listing. (should be off by default)
* Block public access to `.env`, backup files, logs, database dumps, and other sensitive files. BitFire includes these files in the malware scan - so make sure you delete any that are found. BitFire runs after the web server and cant block serving these files, so this is probably the most important step.
BitFire should handle the WordPress-specific security layer, including the WAF, bot filtering, malware detection, file protection, database protection, and runtime attack prevention.
I generally would not install multiple WordPress security plugins that perform the same job. Overlapping firewalls and malware scanners can create conflicts without adding much protection.
For a WordPress site running nginx, the best approach is: keep the configuration tight, minimize the software installed, maintain good backups, and let BitFire handle the application-level and runtime security.
* Keep WordPress core, plugins, and themes updated.
* Remove unused plugins and themes.
* Use strong, unique administrator passwords.
* Keep automatic, off-server backups and test that they can actually be restored.
* Disable PHP execution inside `/wp-content/uploads/`. (if you have access to your nginx configuration)
* Disable nginx directory listing. (should be off by default)
* Block public access to `.env`, backup files, logs, database dumps, and other sensitive files. BitFire includes these files in the malware scan - so make sure you delete any that are found. BitFire runs after the web server and cant block serving these files, so this is probably the most important step.
BitFire should handle the WordPress-specific security layer, including the WAF, bot filtering, malware detection, file protection, database protection, and runtime attack prevention.
I generally would not install multiple WordPress security plugins that perform the same job. Overlapping firewalls and malware scanners can create conflicts without adding much protection.
For a WordPress site running nginx, the best approach is: keep the configuration tight, minimize the software installed, maintain good backups, and let BitFire handle the application-level and runtime security.