Run WordPress over HTTPS on CentOS by placing Nginx in front of PHP-FPM, installing a certificate whose names match your site, redirecting port 80 to 443, and configuring WordPress to use the secure URL. Because Nginx has no .htaccess layer, every rewrite, restriction, and redirect must be written in administrator-managed server blocks. Keep firewalld enabled, leave SELinux enforcing, and test the configuration before every reload.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the finished setup looks like
A browser connects to Nginx on TCP port 443. Nginx presents the certificate and private key, serves static files from the WordPress directory, and sends PHP requests to PHP-FPM through a Unix socket or loopback TCP listener. A separate port-80 server block performs one permanent redirect to the same host and path on HTTPS. WordPress then generates its canonical links, cookies, login pages, and administration URLs with the https:// scheme.
As an Amazon Associate I earn from qualifying purchases.
- Nginx: terminates TLS, handles the HTTP-to-HTTPS redirect, serves static content, applies the WordPress front-controller fallback, and blocks sensitive paths.
- PHP-FPM: executes PHP outside the Nginx worker process and receives requests through the exact socket or address configured in both services.
- WordPress: stores the secure WordPress Address and Site Address and can require TLS for every login and administration request.
- CentOS controls: firewalld exposes only the required services, while SELinux controls whether the web processes may read or execute files.
WordPress officially supports standalone Nginx, including large installations. The important operational difference from Apache is that Nginx cannot read or automatically apply .htaccess; rules that an Apache plugin would normally write must be placed in Nginx configuration and reloaded by an administrator.
Prerequisites and decisions
Use a maintained CentOS Stream release or a compatible Red Hat-family distribution. The exact package names and PHP extension set vary by release, so use the distribution’s supported repositories and package tooling rather than copying packages from an unrelated version.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Item | Decision or requirement |
|---|---|
| Hostname | Choose the production name, such as example.com, and any required www name before requesting the certificate. |
| Web root | Use a dedicated directory such as /var/www/example.com; do not make the entire tree world-writable. |
| PHP handler | Use PHP-FPM on a Unix socket or loopback TCP address. The Nginx fastcgi_pass value must match the PHP-FPM listener exactly. |
| Certificate | Install a certificate covering every production hostname, its private key, and the complete certificate chain. |
| Firewall | Permit HTTP and HTTPS (ports 80 and 443) and make the rules permanent. |
| Policy | Keep SELinux enforcing and correct labels or booleans when access is denied. |
| Database | Install a supported database using the CentOS-compatible package source and create a database and user for WordPress. |
Back up an existing site and database before changing URLs or moving files. A URL change can affect serialized settings, cached pages, feeds, and integrations, so make sure you have console access in case the web site becomes unreachable.
Prepare Nginx, PHP-FPM, and the WordPress directory
Install the server components
On a maintained CentOS Stream host, install Nginx, PHP-FPM, the PHP extensions required by your WordPress version and plugins, and a supported database with dnf. Enable the services so they start at boot, but do not expose the site until the virtual host and certificate are ready.
sudo dnf install nginx php-fpm
sudo systemctl enable --now nginx php-fpmAdd the database server and PHP database driver supplied for your release. WordPress’s current requirements change over time; verify the PHP and database versions supported by the WordPress release you intend to run, and keep the operating system, Nginx, PHP, and WordPress patched.
Create the site root and permissions
Create a separate directory for the site and copy or extract WordPress there. Ownership must allow the Nginx/PHP-FPM policy to read the files and write only the directories that genuinely need writes, normally the uploads directory and selected cache directories. Avoid the unsafe shortcut of recursively granting write access to every file.
sudo mkdir -p /var/www/example.com
sudo chown -R nginx:nginx /var/www/example.comThe correct owner can differ when PHP-FPM runs under a dedicated pool account. Confirm the account in the pool configuration before applying ownership changes. On SELinux-enabled systems, Unix mode bits alone do not determine access; apply the proper security context after placing files.
Configure a PHP-FPM pool
PHP-FPM can listen on a Unix socket or a loopback address. A socket avoids exposing a network listener, while loopback TCP can be convenient when several services share a host. Whichever method you select, use the same target in Nginx.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
[example]
user = nginx
group = nginx
listen = /run/php-fpm/example.sock
listen.owner = nginx
listen.group = nginx
pm = dynamic
pm.max_children = 20
pm.start_servers = 2
pm.min_spare_servers = 2
pm.max_spare_servers = 5The process values above are examples, not universal capacity settings. Size them for available memory, request traffic, and the workload of your plugins. Set an upload limit appropriate for your media files in the pool’s PHP settings or an included configuration file, then restart PHP-FPM after changes.
sudo systemctl restart php-fpm
sudo systemctl status php-fpm --no-pagerBuild the Nginx HTTP and HTTPS server blocks
Port 80: redirect without exceptions
Use one server block for the clear-text hostname. It should return one permanent redirect to the same host and URI under HTTPS. Keeping the original request URI prevents links such as /wp-admin/ or a post permalink from collapsing to the home page.
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Only use $host when the server block accepts exactly the names you intend to serve. If your policy is to canonicalize www to the bare domain, create a separate redirect for the alternate name instead of allowing arbitrary Host headers to influence the destination.
Port 443: TLS, static files, and the front controller
The secure block must listen with SSL enabled, declare the certificate and key, and point its root at the WordPress directory. The private key should be readable by the Nginx master process but inaccessible to ordinary users.
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name example.com www.example.com;
root /var/www/example.com;
index index.php index.html;
ssl_certificate /etc/nginx/tls/example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/example.com/privkey.pem;
client_max_body_size 64m;
location / {
try_files $uri $uri/ /index.php?$args;
}
location = /index.php {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTPS on;
fastcgi_pass unix:/run/php-fpm/example.sock;
}
location ~ .php$ {
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param HTTPS on;
fastcgi_pass unix:/run/php-fpm/example.sock;
}
location ~ /. {
deny all;
}
location ~* ^/wp-content/uploads/.*.php$ {
deny all;
}
}The exact include file supplied by your CentOS package may be named fastcgi_params or fastcgi.conf. Inspect it and ensure the request parameters include the script filename. The try_files directive is the WordPress front-controller fallback: existing files and directories are served directly, while unknown permalinks are sent to index.php with their query arguments.
The dot-file rule blocks requests for names beginning with a period, including accidental exposure of .env or .htaccess. The uploads rule prevents a PHP file copied into the media directory from being executed. If your site uses another upload path, adapt the expression and test that path explicitly.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Validate before every reload
sudo nginx -t
sudo systemctl reload nginxNever reload after a failed syntax test. An incorrectly ordered certificate chain, a missing key, an invalid directive, or a socket path that does not exist can stop Nginx from accepting the new configuration. Check the service journal and Nginx error log when the test fails.
Install and renew the TLS certificate
Obtain a certificate from a certificate authority using its supported validation and renewal method. The certificate names must cover every hostname users will reach. Install the full chain and private key at the paths in the secure server block; a leaf certificate without its intermediate chain can produce browser warnings even when the hostname is correct.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Restrict the private-key file so only the Nginx master process and the administrators who manage TLS can read it.
- Keep the certificate and key outside the public document root.
- Configure automated renewal using the certificate authority’s supported client or service.
- After renewal, run
nginx -tand reload Nginx only if validation succeeds. - Check that the renewed chain, expiration date, and all required hostnames are presented after the reload.
If Nginx refuses to start after a certificate change, inspect the error for a missing file, unreadable key, malformed PEM data, or a chain in the wrong order. Restore the last known-good files if necessary, then correct the renewal deployment hook before trying again.
Tell WordPress that HTTPS is canonical
Set the two site URLs
Once the port-443 host responds correctly, open the WordPress settings and set both WordPress Address (URL) and Site Address (URL) to the secure form, such as https://example.com. Do not add a trailing slash unless the field already uses WordPress’s normal format. If the dashboard is inaccessible, set the values in the database or temporarily define them in wp-config.php while repairing the installation.
Force secure administration
Add the following before the line that says WordPress has stopped editing the file:
define( 'FORCE_SSL_ADMIN', true );This forces login and administration requests to use TLS. It does not replace the Nginx redirect or the two canonical URL settings; all three layers should agree.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Account for a reverse proxy
If another proxy or load balancer terminates TLS before the request reaches Nginx, pass the original protocol in X-Forwarded-Proto. WordPress must be told to treat that header as HTTPS, otherwise it may issue a redirect loop or generate insecure links.
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
&& $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
$_SERVER['HTTPS'] = 'on';
}Only trust this header from a proxy you control. Configure the proxy to overwrite untrusted client values, and ensure the proxy-to-Nginx connection is protected when it crosses an untrusted network.
Open firewalld ports permanently
Permit the HTTP and HTTPS services, persist the changes, and reload firewalld. Runtime-only rules disappear after a restart.
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-services
sudo firewall-cmd --list-services --permanentIf you prefer explicit ports, add TCP 80 and 443 instead of the service names. Confirm both the active and permanent configurations; a successful browser test proves only that the current runtime zone permits traffic, not that the rule will survive reboot.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep SELinux enforcing and fix labels correctly
SELinux is commonly installed on CentOS and other Red Hat-family systems. It can deny Nginx or PHP-FPM access even when ordinary Unix permissions look correct. Do not disable it as a first response.
Inspect the context and denial
getenforce
ls -Z /var/www/example.com
sudo ausearch -m AVC -ts recentUse the denial details to identify the file, process, and requested operation. A site root normally needs a web-content context that permits reading; directories that PHP must write need the appropriate writable web-content type. Apply labels with the SELinux management tools available for your release, then restore contexts:
sudo semanage fcontext -a -t httpd_sys_content_t '/var/www/example.com(/.*)?'
sudo restorecon -Rv /var/www/example.comDo not label the entire tree writable merely to silence an error. If WordPress needs to write uploads, assign the narrowly appropriate type to that directory and review whether a PHP-FPM or web-server boolean is required. After changing labels, repeat the upload and page tests and review the audit log for remaining denials.
Apply WordPress-specific Nginx restrictions
- Block hidden files and directories, except for any explicitly required well-known path used by certificate validation.
- Deny PHP execution beneath
wp-content/uploadsor an equivalent media directory. - Do not expose configuration backups, database dumps, editor swap files, or logs beneath the document root.
- Use the minimum write permissions needed for updates and media uploads; avoid recursive
chmod 777. - Review plugin-generated Nginx snippets before including them, because Nginx will not inherit Apache’s
.htaccessprotections.
To verify the uploads rule, create a harmless file such as uploads/probe.php containing a simple PHP marker, request it in a browser, and confirm that Nginx returns a denial rather than executing it. Remove the file immediately after the test.
Recommended Free Tools
Verification checklist before announcing the site
- Run
nginx -tand reload only after a successful result. - Request the HTTP hostname and confirm exactly one redirect to the matching HTTPS host and URI.
- Open the HTTPS site and inspect the certificate hostname, validity period, and complete chain.
- Visit
/wp-login.php, sign in, and open the dashboard over HTTPS. - View page source and browser network requests; correct any remaining HTTP image, script, stylesheet, or form URL.
- Upload an ordinary media file and confirm it can be retrieved.
- Place the harmless PHP probe in uploads and verify that execution is denied, then delete it.
- Check both runtime and permanent firewalld rules for HTTP and HTTPS.
- Review Nginx, PHP-FPM, and SELinux logs for permission failures, upstream errors, redirect loops, or denied requests.
- Test a pretty permalink, a missing page, a static asset, and a request with query parameters to ensure the front-controller fallback preserves arguments.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| 502 Bad Gateway | PHP-FPM is stopped or Nginx points to the wrong socket or port. | Check systemctl status php-fpm, confirm the pool’s listen value, and verify socket ownership and SELinux denials. |
| Nginx will not reload | Syntax error, missing certificate file, unreadable key, or malformed chain. | Run nginx -t and read the exact file and line reported by the service journal. |
| Redirect loop | WordPress sees an HTTP request after a proxy terminated TLS. | Pass and validate X-Forwarded-Proto, set $_SERVER['HTTPS'] only for the trusted proxy, and check both WordPress URLs. |
| Permalinks return 404 | The front-controller fallback is missing or the request is reaching the wrong server block. | Confirm try_files $uri $uri/ /index.php?$args, the document root, and the active server_name. |
| Uploads fail with permission errors | Unix ownership, SELinux context, or PHP upload limits prevent writing. | Inspect ls -Z, audit denials, pool limits, and the writable directory’s ownership; do not make the whole site writable. |
| Browser reports insecure content | Stored HTTP URLs remain in posts, themes, plugins, or cached HTML. | Search the database and generated markup for the old scheme, clear caches, and regenerate affected assets without changing unrelated URLs. |
| HTTP works but HTTPS times out | TCP 443 is blocked or Nginx is not listening on the secure address. | Check firewalld’s active zone, the Nginx listen directives, and the service status. |
Self-managed CentOS versus managed WordPress hosting
A self-managed installation gives you direct control over Nginx server blocks, PHP-FPM pools, filesystem layout, firewalld, SELinux, caching, and performance tuning. That control also makes you responsible for certificate renewal, operating-system and package updates, backups, monitoring, incident response, and recovery when a configuration change fails.
| Responsibility | Self-managed CentOS/Nginx | Managed WordPress service |
|---|---|---|
| Nginx and PHP-FPM tuning | You choose versions, pools, limits, and configuration. | The provider chooses supported defaults; custom server rules may be limited. |
| Certificate automation | You obtain, install, renew, and test the chain and key. | Often automated, but confirm coverage, renewal behavior, and access to certificates. |
| Patching | You schedule and verify WordPress, PHP, Nginx, database, and OS updates. | The provider may patch some layers; establish what remains your responsibility. |
| SELinux and firewall | You investigate labels, AVC denials, zones, and persistent rules. | Usually abstracted away, with less control over low-level policy. |
| Backups and monitoring | You select storage, retention, restore tests, metrics, and alerting. | May be included, but verify frequency, retention, restore access, and monitoring scope. |
| Support and recovery | Console access and your runbooks are the recovery path. | Provider support may shorten incidents, subject to its service boundaries. |
Choose self-management when you need operating-system and web-server control and can maintain those layers. Choose a managed service when reducing patching, certificate, backup, and monitoring work is more valuable than customizing the host. In either case, confirm that the service supports current WordPress, PHP, and database versions.
Maintenance after the migration
- Apply security updates to WordPress, plugins, themes, PHP, Nginx, the database, and CentOS on a defined schedule.
- Monitor certificate expiration and test renewal before the existing certificate becomes urgent.
- Keep tested backups of both the database and uploaded files, and perform a restore drill.
- Review Nginx, PHP-FPM, firewalld, and SELinux logs after upgrades or permission changes.
- Re-run the HTTPS, redirect, login, permalink, upload, and uploads-PHP-denial checks after major configuration changes.
- Remove obsolete HTTP endpoints, temporary probes, old keys, and unused virtual-host files.
Obsolete PHP or database versions can expose a WordPress site to security vulnerabilities even when TLS is configured correctly. HTTPS protects data in transit; it does not replace timely patching, least-privilege permissions, backups, or monitoring.
Frequently Asked Questions
Can WordPress run on Nginx without Apache?
Yes. WordPress supports Nginx directly, but Nginx does not process .htaccess files. Put rewrite, access-control, and HTTPS redirect rules in the Nginx server configuration and reload it after validation.
Why does HTTPS create a redirect loop behind a proxy?
The proxy may terminate TLS while forwarding HTTP to Nginx, so WordPress believes the original request was insecure. Pass a trusted X-Forwarded-Proto value and set WordPress’s HTTPS detection for that proxy, then verify the two canonical site URLs.
What should remain open in firewalld?
For a normal public WordPress site, persist HTTP and HTTPS access—TCP ports 80 and 443—then reload firewalld. Keep database, PHP-FPM, and administration ports closed to the public unless a documented architecture requires them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
