Recommended Free Tools
Put NGINX on the public-facing server and proxy each web request to the other server over HTTP. The backend server continues to run WordPress and execute PHP through its own local PHP-FPM or Apache/PHP stack; the front NGINX does not connect to a PHP-FPM socket on the remote machine.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The details that make this reliable are the upstream address, the forwarded host and protocol headers, the exact proxy_pass URI behavior, and WordPress’s awareness that the original visitor used HTTPS. The configuration below covers those points, plus firewalling, validation, permalink failures, and redirect-loop recovery.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat the two-server arrangement does
A reverse proxy is an HTTP intermediary. A browser connects to the public NGINX instance, NGINX sends that request to the specified backend server, receives the backend response, and returns it to the browser. WordPress, PHP, plugins, themes, and the database remain on the backend unless you deliberately distribute them elsewhere.
The request path is therefore:
- The visitor requests the public hostname, such as
https://example.com/. - The public NGINX server terminates TLS if you configured HTTPS there, then passes the request to the backend HTTP listener.
- The backend web server routes the request to WordPress. If the request needs PHP, that backend web server invokes its local PHP-FPM service or its local Apache/PHP integration.
- The backend response travels back through the proxy and is sent to the visitor.
This separation matters because proxy_pass speaks HTTP, while fastcgi_pass speaks FastCGI. A PHP-FPM Unix socket normally exists only on the machine running PHP-FPM; pointing the public server at a path that exists on the backend cannot work.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the topology before changing configuration
| Arrangement | TLS termination | PHP-FPM location | Network boundary | Operational trade-off | Failure impact |
|---|---|---|---|---|---|
| Backend exposed directly | On the WordPress server | Local to that web server | The application listener is reachable by visitors | Simplest path, but fewer isolation options | A backend outage is immediately a public outage |
| Single server with NGINX and PHP-FPM | On the same server as WordPress | Local to NGINX | No inter-server proxy hop | Fewer moving parts; compute and application share one host | One host failure affects every layer |
| Public NGINX plus private WordPress backend | Usually on the public NGINX server | Local to the backend web server | Firewall can limit the backend listener to the proxy | Separates edge duties from application duties, but adds header, routing, and monitoring work | The site is unavailable if either proxy or backend is unavailable |
The two-server design is appropriate when you need a separate edge host, an existing WordPress machine, or a private application network. It is not a way to share a PHP-FPM socket between hosts.
Prerequisites and information to collect
Before editing NGINX, establish these facts:
- The public hostname and every name visitors will use, for example
example.comandwww.example.com. - The backend hostname or IP address that the proxy can reach, plus its HTTP port. NGINX accepts either a domain name or an IP address, with an optional port, in
proxy_pass. - The backend’s expected Host header. WordPress should be configured for the public hostname, not an internal name, unless you intentionally run a different site there.
- Which machine terminates TLS. If that is the public NGINX server, the backend normally receives HTTP and must be told that the original request was HTTPS.
- A firewall rule that permits the backend HTTP port from the proxy’s address while denying unnecessary public access.
- Administrative access to both NGINX configurations and to the WordPress
wp-config.phpfile when protocol handling needs adjustment.
From the proxy host, verify that the backend already serves WordPress correctly before introducing the proxy. A useful check is an HTTP request to the backend with the public Host header, for example:
curl -I -H 'Host: example.com' http://10.0.0.20/Replace the address and port with the real private endpoint. A successful response here proves basic reachability and gives you a baseline for later troubleshooting; it does not prove that permalinks or HTTPS handling are correct.
Prepare the backend WordPress server
Keep PHP execution on the backend
The backend web server should have a functioning WordPress document root, its normal rewrite rules, and a local PHP runtime. If it uses NGINX, its PHP location should pass scripts to the PHP-FPM service on that same machine. If it uses Apache, Apache should continue to hand PHP requests to its configured PHP handler. Do not copy a backend-only socket path into the public proxy configuration.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Make the public hostname authoritative
WordPress builds canonical links, login redirects, image URLs, and stylesheet URLs from its configured site address. Configure the installation for the public hostname and the intended scheme. If the public site is HTTPS, the WordPress and site URLs should ultimately be HTTPS URLs; otherwise WordPress may emit HTTP links that browsers upgrade or block.
Keep the application listener private
Restrict the backend firewall to the proxy’s source address or private network. Expose only the port that the proxy needs. This reduces the chance that visitors bypass the public NGINX layer and preserves one consistent hostname, TLS policy, and client-IP handling path.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Create the public NGINX reverse-proxy server block
For an HTTP-only front end, a minimal server block is:
server {
listen 80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://10.0.0.20:80;
}
}Use the real public names and backend endpoint. The four headers are intentional:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Host $hosttells the backend which public hostname the visitor requested. Without it, NGINX’s default upstream Host behavior can make WordPress generate links for an internal name or trigger a redirect to the wrong domain.X-Real-IP $remote_addrcarries the address seen by the proxy.X-Forwarded-For $proxy_add_x_forwarded_forappends the proxy’s view of the client address to the forwarding chain. Configure backend logging and security tools to trust this header only when it came through your proxy.X-Forwarded-Proto $schemerecords whether the visitor connected with HTTP or HTTPS at the front end. WordPress needs this value when TLS ends at the proxy.
NGINX changes the upstream Host and Connection headers by default. Explicitly setting the Host and forwarding headers prevents the most common canonical-URL and client-address errors.
Understand the proxy_pass URI rule
Whether proxy_pass contains a URI suffix changes how NGINX constructs the upstream request:
Free tools Windows power users keep installed
One-click scans. No signup required.
| Configuration | Effect | Typical consequence |
|---|---|---|
location / { proxy_pass http://backend; } |
No URI is supplied, so NGINX passes the original or normalized request URI. | Usually the least surprising choice when the backend hosts WordPress at its root. |
location /blog/ { proxy_pass http://backend/; } |
The part matching /blog/ is replaced by the slash URI supplied to proxy_pass. |
The backend receives a path with the prefix removed. |
location /blog/ { proxy_pass http://backend; } |
No replacement URI is specified, so the original path, including /blog/, is passed. |
Useful only when WordPress is actually configured to live below that prefix. |
A stray trailing path can break pretty permalinks, static assets, media URLs, or the login route. Decide whether WordPress is installed at the backend root or under a prefix, then test a home page, a known post URL, a CSS file, and /wp-admin/ after every change.
When the front end terminates HTTPS
In the common arrangement, the visitor connects to HTTPS on the public NGINX server while the proxy connects to the backend over HTTP. The backend therefore sees an HTTP socket even though the original request was secure. If WordPress is not given the forwarded protocol, it can redirect every request to HTTPS, receive the same request through the proxy, and redirect again indefinitely.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Keep proxy_set_header X-Forwarded-Proto $scheme; in the TLS-facing server block. On the backend, make WordPress recognize HTTPS only when that header was supplied by your trusted proxy. A commonly used wp-config.php pattern is:
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])
&& $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
$_SERVER['HTTPS'] = 'on';
}Apply such logic only when requests to the backend are restricted to the proxy or another trusted edge; otherwise an untrusted client could spoof the header. If more than one proxy is involved, define a consistent forwarding policy so the backend receives the original protocol rather than whichever hop last rewrote it.
Set WordPress’s public WordPress Address and Site Address to the real HTTPS hostname, either in the administration screen or with constants in wp-config.php:
define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');Do not add these constants if your installation already defines the values elsewhere; maintain one authoritative setting. After enabling TLS, check the home page, a post with a pretty permalink, /wp-login.php, /wp-admin/, an image, and a stylesheet. Every redirect and asset URL should remain on the intended HTTPS hostname.
WordPress rewrites and configuration boundaries
NGINX has no directory-level equivalent of Apache’s .htaccess or IIS’s web.config, and WordPress cannot modify NGINX configuration automatically. Put rewrite, access-control, upload-size, and cache rules in the relevant NGINX server configuration, or maintain them on the backend web server that actually serves WordPress.
For a root installation, the backend must route unknown paths to WordPress’s front controller according to its existing NGINX or Apache setup. The public proxy should normally pass those paths unchanged. If the proxy strips a prefix accidentally, or the backend lacks its own front-controller rule, the home page may work while posts and pages return 404 responses.
Changing the permalink setting in WordPress does not create NGINX rules. It may refresh rewrite data inside WordPress, but the web server still needs a matching configuration. Treat permalink failures as a routing/configuration problem, not as a PHP-FPM connection problem.
Deploy safely and verify the result
- Save the existing public NGINX configuration and record the backend endpoint, hostname, and listening port.
- Confirm the backend response directly from the proxy host, including a request with the public Host header.
- Add the
serverblock and thelocation /proxy settings. Use the same proxy header policy in the TLS server block if you have separate listeners for ports 80 and 443. - Check the
proxy_passURI choice against the intended WordPress path. Root installations generally need no URI suffix. - Validate syntax with
nginx -t. Fix every reported error before reloading. - Reload NGINX using the service manager for your distribution, then watch both the public proxy log and the backend web-server log while making a request.
- Test the home page, one pretty permalink,
/wp-admin/, login, an image, a stylesheet, and a form submission. Repeat the checks over HTTPS if TLS terminates at the proxy. - Only after the proxy path is working should you close unnecessary public access to the backend listener.
A configuration test confirms syntax; it does not confirm DNS, firewall reachability, WordPress canonical URLs, or PHP behavior. Those require the request checks above.
Diagnose common failures
| Symptom | Likely cause | What to inspect |
|---|---|---|
| 502 Bad Gateway or connection refused | The proxy cannot reach the backend, the port is wrong, or the backend web server is stopped. | Connect from the proxy host to the backend address and port; check the backend listener and firewall before changing WordPress. |
| Infinite HTTP-to-HTTPS redirects | WordPress sees the backend HTTP connection but is not honoring the trusted forwarded protocol. | Confirm the proxy sends X-Forwarded-Proto, the backend applies HTTPS handling for that trusted proxy, and the WordPress URLs use the intended scheme. |
| Redirects to an internal hostname | The backend received its default Host value or WordPress is configured with an internal site URL. | Verify proxy_set_header Host $host and the WordPress Address and Site Address. |
| Home page works but posts return 404 | The backend front-controller rewrite is missing, or a URI suffix in proxy_pass altered the path. |
Compare the request URI in both logs, remove an unintended replacement URI, and repair the backend rewrite configuration. |
| Images or CSS load over HTTP | WordPress or a plugin generated absolute HTTP URLs. | Check the configured site scheme, forwarded-protocol handling, and stored content URLs; inspect the HTML source for the generated links. |
| Login returns to the login page | WordPress’s perceived scheme or hostname changes between requests, so secure cookies or redirects do not match. | Check Host and forwarded-protocol headers, HTTPS recognition, and the public site URL. |
| Real visitor addresses are missing in backend logs | The backend is logging the proxy address instead of the forwarded client address. | Confirm the X-Real-IP and X-Forwarded-For headers and configure the backend logging format to use a trusted forwarded value. |
| Large uploads fail at the edge | An NGINX request-size limit is lower than the WordPress or backend limit. | Review upload-size settings on the public proxy and backend; the effective limit is governed by the smallest applicable setting. |
When a request fails, compare the public access log with the backend access log. If it appears in the public log but not the backend log, focus on DNS, firewall, address, port, and proxy syntax. If it appears in both, inspect Host, protocol, URI, WordPress redirects, and PHP handling on the backend.
Security and operational practices
- Allow the backend application port only from the proxy network or explicitly approved proxy addresses.
- Use a stable backend address. If a hostname can resolve to changing addresses, confirm that your NGINX version and deployment process handle DNS changes as intended.
- Keep the public Host header and WordPress’s configured hostname aligned. Do not accept arbitrary Host values if your server block is meant for one site.
- Decide whether the proxy-to-backend hop also needs encryption. The basic pattern uses HTTP on that private hop; network exposure, compliance requirements, and trust boundaries determine whether you should use HTTPS there.
- Monitor both layers. A healthy proxy with an unavailable backend still produces a site outage, while a healthy backend can be inaccessible because of a proxy or firewall error.
- Keep rewrite, access, upload, and caching rules in version-controlled server configuration where possible. WordPress cannot insert those rules into NGINX automatically.
Do not add caching until the un-cached proxy path, authentication, cookies, and administrative URLs work correctly. A cache rule that ignores cookies can serve one visitor’s response to another, and a cache rule that mishandles the public scheme can preserve redirect problems.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Final validation checklist
- The backend serves WordPress correctly when requested from the proxy host.
- The backend firewall permits the proxy and blocks unintended direct access.
- The public server block names every intended public hostname.
proxy_passpoints to the reachable backend HTTP endpoint, not a remote PHP-FPM socket.Host,X-Real-IP,X-Forwarded-For, andX-Forwarded-Protoare set deliberately.- The URI suffix behavior matches the WordPress installation path.
nginx -tsucceeds before reload.- Home page, pretty permalinks, media, CSS, login, and
/wp-admin/work through the public hostname. - When TLS terminates at the proxy, WordPress recognizes the forwarded HTTPS request without redirect loops.
- Proxy and backend logs show the expected URI, hostname, and client-address chain.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
